{
  "@id": "urn:uuid:e527e338-b60d-480a-887d-3c344894f72c",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 27,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-30T15:44:00.110412+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2016-5018 does not affect version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper. Apache Tomcat 8.5.78 is not affected by CVE-2016-5018. The vulnerability involved a SecurityManager bypass via the JspRuntimeLibrary.introspecthelper() method, which executed bean introspection with elevated privileges using AccessController.doPrivileged(). The fix was applied by Apache upstream in commit 648122fef8 (Aug 2, 2016) and was already present in version 8.5.78 when TuxCare onboarded it (commit fb98844404, Sep 20, 2026). The vulnerable code pattern (PrivilegedIntrospectHelper class and doPrivileged wrapper) is not present in the target.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5018"
      },
      "impact_statement": "Apache Tomcat 8.5.78 is not affected by CVE-2016-5018. The vulnerability involved a SecurityManager bypass via the JspRuntimeLibrary.introspecthelper() method, which executed bean introspection with elevated privileges using AccessController.doPrivileged(). The fix was applied by Apache upstream in commit 648122fef8 (Aug 2, 2016) and was already present in version 8.5.78 when TuxCare onboarded it (commit fb98844404, Sep 20, 2026). The vulnerable code pattern (PrivilegedIntrospectHelper class and doPrivileged wrapper) is not present in the target."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:37:14.382670+00:00",
      "status_notes": "Vulnerability CVE-2017-12615 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper.",
      "vulnerability": {
        "name": "CVE-2017-12615"
      },
      "action_statement": "Vulnerability CVE-2017-12615 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2017-12617 does not affect version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper. The target (Apache Tomcat 8.5.78) is not affected by CVE-2017-12617. The vulnerability allowed uploading JSP files via HTTP PUT with specially crafted paths ending in '/' to bypass security checks (the Java File API drops trailing slashes). The upstream Apache Tomcat project fixed this in commits 506d862e7e and 4cf7dab882 (authored by Mark Thomas, September 2017) by adding checks that reject file write operations when the path ends with '/'. These fixes were already present in Apache Tomcat release 8.5.78 before TuxCare onboarded it (first TuxCare commit: fb98844404 \"Onboard version 8.5.78\" by amoniatovskiy@cloudlinux.com). The defensive code is verified present at AbstractFileResourceSet.java:69 and DirResourceSet.java:252.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-12617"
      },
      "impact_statement": "The target (Apache Tomcat 8.5.78) is not affected by CVE-2017-12617. The vulnerability allowed uploading JSP files via HTTP PUT with specially crafted paths ending in '/' to bypass security checks (the Java File API drops trailing slashes). The upstream Apache Tomcat project fixed this in commits 506d862e7e and 4cf7dab882 (authored by Mark Thomas, September 2017) by adding checks that reject file write operations when the path ends with '/'. These fixes were already present in Apache Tomcat release 8.5.78 before TuxCare onboarded it (first TuxCare commit: fb98844404 \"Onboard version 8.5.78\" by amoniatovskiy@cloudlinux.com). The defensive code is verified present at AbstractFileResourceSet.java:69 and DirResourceSet.java:252."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T14:57:45.485772+00:00",
      "status_notes": "Vulnerability CVE-2017-5648 does not affect version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper. Target Tomcat 8.5.78 is not affected by CVE-2017-5648. The vulnerability pattern (passing internal Request objects to application listeners without facade wrapping) is not present. All 7 call sites to fireRequestInitEvent() and fireRequestDestroyEvent() correctly use request.getRequest() to pass facade-wrapped objects. The fix was introduced by upstream commit 0f7b9465d5 (author: Mark Thomas, markt@apache.org) in March 2017 for Tomcat 8.5.12+, which was already present in the upstream 8.5.78 release when TuxCare onboarded it. CVE affects 8.5.0-8.5.11; target 8.5.78 is above this range.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-5648"
      },
      "impact_statement": "Target Tomcat 8.5.78 is not affected by CVE-2017-5648. The vulnerability pattern (passing internal Request objects to application listeners without facade wrapping) is not present. All 7 call sites to fireRequestInitEvent() and fireRequestDestroyEvent() correctly use request.getRequest() to pass facade-wrapped objects. The fix was introduced by upstream commit 0f7b9465d5 (author: Mark Thomas, markt@apache.org) in March 2017 for Tomcat 8.5.12+, which was already present in the upstream 8.5.78 release when TuxCare onboarded it. CVE affects 8.5.0-8.5.11; target 8.5.78 is above this range."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T14:57:45.485772+00:00",
      "status_notes": "Vulnerability CVE-2018-11784 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper.",
      "vulnerability": {
        "name": "CVE-2018-11784"
      },
      "action_statement": "Vulnerability CVE-2018-11784 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T14:57:45.485772+00:00",
      "status_notes": "Vulnerability CVE-2018-1304 does not affect version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper. not_affected \u2014 The target Apache Tomcat 8.5.78 is not affected by CVE-2018-1304. The vulnerability was fixed in upstream Apache Tomcat 8.5.28 (February 2018) by commit 5af7c13cff, authored by Mark Thomas (markt@apache.org). This fix was already present when TuxCare onboarded version 8.5.78, as confirmed by the fix commit being an ancestor of the first TuxCare commit (fb98844404 \"Onboard version 8.5.78\"). The ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1304"
      },
      "impact_statement": "not_affected \u2014 The target Apache Tomcat 8.5.78 is not affected by CVE-2018-1304. The vulnerability was fixed in upstream Apache Tomcat 8.5.28 (February 2018) by commit 5af7c13cff, authored by Mark Thomas (markt@apache.org). This fix was already present when TuxCare onboarded version 8.5.78, as confirmed by the fix commit being an ancestor of the first TuxCare commit (fb98844404 \"Onboard version 8.5.78\"). The ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T14:57:45.485772+00:00",
      "status_notes": "Vulnerability CVE-2018-1305 does not affect version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper. not_affected \u2014 CVE-2018-1305 is NOT present in Apache Tomcat 8.5.78. The vulnerability affected versions 8.5.0 to 8.5.27. The target version 8.5.78 includes the upstream fix (commit 2349801827, Feb 2018) which moved ServletSecurity annotation processing from servlet load time to application startup, eliminating the race condition where security constraints could be bypassed based on servlet load order. The fi...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1305"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1305 is NOT present in Apache Tomcat 8.5.78. The vulnerability affected versions 8.5.0 to 8.5.27. The target version 8.5.78 includes the upstream fix (commit 2349801827, Feb 2018) which moved ServletSecurity annotation processing from servlet load time to application startup, eliminating the race condition where security constraints could be bypassed based on servlet load order. The fi..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T14:57:45.485772+00:00",
      "status_notes": "Vulnerability CVE-2018-1336 does not affect version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper. CVE-2018-1336 is NOT present in Tomcat 8.5.78. The vulnerability (improper overflow handling in UTF-8 decoder causing infinite loops with supplementary characters) was fixed by upstream Apache Tomcat commit e00812b94e on 2018-04-27. This fix was already included in the upstream 8.5.78 release that TuxCare onboarded. The defense code is present at Utf8Decoder.java:280-286, which rewinds input position by 3 bytes before signaling OVERFLOW when decoding 4-byte UTF-8 sequences, preventing the infinite loop that would occur without proper position management.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1336"
      },
      "impact_statement": "CVE-2018-1336 is NOT present in Tomcat 8.5.78. The vulnerability (improper overflow handling in UTF-8 decoder causing infinite loops with supplementary characters) was fixed by upstream Apache Tomcat commit e00812b94e on 2018-04-27. This fix was already included in the upstream 8.5.78 release that TuxCare onboarded. The defense code is present at Utf8Decoder.java:280-286, which rewinds input position by 3 bytes before signaling OVERFLOW when decoding 4-byte UTF-8 sequences, preventing the infinite loop that would occur without proper position management."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T14:57:45.485772+00:00",
      "status_notes": "Vulnerability CVE-2018-8014 does not affect version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper. CVE-2018-8014 is not present in Apache Tomcat 8.5.78. The vulnerability affected Tomcat 8.5.0 to 8.5.31 with insecure CORS filter defaults (supportsCredentials=true for all origins). The upstream fix was applied in version 8.5.32 (May 2018) by commit 60f596a21f, authored by Mark Thomas (markt@apache.org). Version 8.5.78 includes this fix: DEFAULT_ALLOWED_ORIGINS=\"\" (not \"*\"), DEFAULT_SUPPORTS_CREDENTIALS=\"false\" (not \"true\"), validation preventing supportsCredentials=true with allowedOrigins=*, and simplified logic in addStandardHeaders. The vulnerable pattern is absent because the fix shipped in the upstream release before TuxCare onboarded this version.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-8014"
      },
      "impact_statement": "CVE-2018-8014 is not present in Apache Tomcat 8.5.78. The vulnerability affected Tomcat 8.5.0 to 8.5.31 with insecure CORS filter defaults (supportsCredentials=true for all origins). The upstream fix was applied in version 8.5.32 (May 2018) by commit 60f596a21f, authored by Mark Thomas (markt@apache.org). Version 8.5.78 includes this fix: DEFAULT_ALLOWED_ORIGINS=\"\" (not \"*\"), DEFAULT_SUPPORTS_CREDENTIALS=\"false\" (not \"true\"), validation preventing supportsCredentials=true with allowedOrigins=*, and simplified logic in addStandardHeaders. The vulnerable pattern is absent because the fix shipped in the upstream release before TuxCare onboarded this version."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T14:57:45.485772+00:00",
      "status_notes": "Vulnerability CVE-2018-8034 does not affect version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper. CVE-2018-8034 (missing hostname verification in WebSocket TLS connections) is NOT present in Apache Tomcat 8.5.78. The vulnerability was fixed by upstream developer Mark Thomas in commit f6bf951acb (June 2018), which added mandatory hostname verification via setEndpointIdentificationAlgorithm(\"HTTPS\"). This fix was already present in the upstream Apache Tomcat 8.5.78 release (2022) before TuxCare onboarded it in September 2026. The target code at WsWebSocketContainer.java:950-956 unconditionally applies hostname verification to all WebSocket TLS connections with no bypass paths.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-8034"
      },
      "impact_statement": "CVE-2018-8034 (missing hostname verification in WebSocket TLS connections) is NOT present in Apache Tomcat 8.5.78. The vulnerability was fixed by upstream developer Mark Thomas in commit f6bf951acb (June 2018), which added mandatory hostname verification via setEndpointIdentificationAlgorithm(\"HTTPS\"). This fix was already present in the upstream Apache Tomcat 8.5.78 release (2022) before TuxCare onboarded it in September 2026. The target code at WsWebSocketContainer.java:950-956 unconditionally applies hostname verification to all WebSocket TLS connections with no bypass paths."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T15:44:00.110412+00:00",
      "status_notes": "Vulnerability CVE-2018-8037 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper.",
      "vulnerability": {
        "name": "CVE-2018-8037"
      },
      "action_statement": "Vulnerability CVE-2018-8037 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T14:57:45.485772+00:00",
      "status_notes": "Vulnerability CVE-2019-0199 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper.",
      "vulnerability": {
        "name": "CVE-2019-0199"
      },
      "action_statement": "Vulnerability CVE-2019-0199 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T14:57:45.485772+00:00",
      "status_notes": "Vulnerability CVE-2019-0221 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper.",
      "vulnerability": {
        "name": "CVE-2019-0221"
      },
      "action_statement": "Vulnerability CVE-2019-0221 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T14:57:45.485772+00:00",
      "status_notes": "Vulnerability CVE-2019-0232 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper.",
      "vulnerability": {
        "name": "CVE-2019-0232"
      },
      "action_statement": "Vulnerability CVE-2019-0232 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T15:44:00.110412+00:00",
      "status_notes": "Vulnerability CVE-2019-10072 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper.",
      "vulnerability": {
        "name": "CVE-2019-10072"
      },
      "action_statement": "Vulnerability CVE-2019-10072 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T14:57:45.485772+00:00",
      "status_notes": "Vulnerability CVE-2019-12418 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper.",
      "vulnerability": {
        "name": "CVE-2019-12418"
      },
      "action_statement": "Vulnerability CVE-2019-12418 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:28:44.006786+00:00",
      "status_notes": "Vulnerability CVE-2019-17563 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper.",
      "vulnerability": {
        "name": "CVE-2019-17563"
      },
      "action_statement": "Vulnerability CVE-2019-17563 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2020-11996 does not affect version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper. CVE-2020-11996 affects Apache Tomcat 8.5.0 to 8.5.55. The target repository is version 8.5.78, which contains the upstream fix committed by Mark Thomas (markt@apache.org) in May-September 2020. The vulnerable code pattern - a loop iterating through numeric stream ID ranges - has been replaced with iteration over actual existing streams using ConcurrentNavigableMap.subMap(). This prevents CPU exhaustion when processing HTTP/2 requests with large stream ID gaps. The fix was present in upstream tag 8.5.56 and was already included when TuxCare onboarded version 8.5.78.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11996"
      },
      "impact_statement": "CVE-2020-11996 affects Apache Tomcat 8.5.0 to 8.5.55. The target repository is version 8.5.78, which contains the upstream fix committed by Mark Thomas (markt@apache.org) in May-September 2020. The vulnerable code pattern - a loop iterating through numeric stream ID ranges - has been replaced with iteration over actual existing streams using ConcurrentNavigableMap.subMap(). This prevents CPU exhaustion when processing HTTP/2 requests with large stream ID gaps. The fix was present in upstream tag 8.5.56 and was already included when TuxCare onboarded version 8.5.78."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:28:44.006786+00:00",
      "status_notes": "Vulnerability CVE-2020-1935 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper.",
      "vulnerability": {
        "name": "CVE-2020-1935"
      },
      "action_statement": "Vulnerability CVE-2020-1935 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T14:57:45.485772+00:00",
      "status_notes": "Vulnerability CVE-2020-1938 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper.",
      "vulnerability": {
        "name": "CVE-2020-1938"
      },
      "action_statement": "Vulnerability CVE-2020-1938 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2020-9484 does not affect version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper. CVE-2020-9484 deserialization vulnerability is NOT present in Apache Tomcat 8.5.78. The fix was authored by Mark Thomas (Apache upstream) on May 5, 2020, and shipped in Apache Tomcat 8.5.55. Version 8.5.78 inherits this fix from upstream. The FileStore.java file at lines 355-358 implements path traversal validation that rejects session IDs attempting to escape the storage directory, preventing deserialization of attacker-controlled files. CVE affected versions: 8.5.0 to 8.5.54; target version 8.5.78 is after the fixed version.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9484"
      },
      "impact_statement": "CVE-2020-9484 deserialization vulnerability is NOT present in Apache Tomcat 8.5.78. The fix was authored by Mark Thomas (Apache upstream) on May 5, 2020, and shipped in Apache Tomcat 8.5.55. Version 8.5.78 inherits this fix from upstream. The FileStore.java file at lines 355-358 implements path traversal validation that rejects session IDs attempting to escape the storage directory, preventing deserialization of attacker-controlled files. CVE affected versions: 8.5.0 to 8.5.54; target version 8.5.78 is after the fixed version."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2021-24122 does not affect version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper. not_affected \u2014 CVE-2021-24122 affects Apache Tomcat 8.5.0 to 8.5.59. The target is version 8.5.78, which already contains the upstream fix (commit 920dddbdb9 from 2020-11-06) that rejects colon ':' characters in Windows filenames. The fix was shipped in the upstream release before TuxCare onboarded version 8.5.78 on 2022-03-31. The vulnerable code pattern (missing ':' in isInvalidWindowsFilename check) is not...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-24122"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-24122 affects Apache Tomcat 8.5.0 to 8.5.59. The target is version 8.5.78, which already contains the upstream fix (commit 920dddbdb9 from 2020-11-06) that rejects colon ':' characters in Windows filenames. The fix was shipped in the upstream release before TuxCare onboarded version 8.5.78 on 2022-03-31. The vulnerable code pattern (missing ':' in isInvalidWindowsFilename check) is not..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T15:44:00.110412+00:00",
      "status_notes": "Vulnerability CVE-2021-25122 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper.",
      "vulnerability": {
        "name": "CVE-2021-25122"
      },
      "action_statement": "Vulnerability CVE-2021-25122 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:28:44.006786+00:00",
      "status_notes": "Vulnerability CVE-2021-25329 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper.",
      "vulnerability": {
        "name": "CVE-2021-25329"
      },
      "action_statement": "Vulnerability CVE-2021-25329 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2022-42252 is fixed in version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper.",
      "vulnerability": {
        "name": "CVE-2022-42252"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2022-45143 does not affect version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper. CVE-2022-45143 affects JsonErrorReportValve, which does not exist in Tomcat 8.5.78. The vulnerability involves missing JSON escaping in type/message/description fields. The target version only has ErrorReportValve, which generates HTML error reports with proper HTML escaping (Escape.htmlElementContent). JsonErrorReportValve was introduced upstream on 2020-10-14 in versions 8.5.83+, 9.0.40+, and 10.1.0+, never backported to 8.5.78. The attack chain (user-provided error data \u2192 manipulated JSON output) cannot complete because JSON error reporting does not exist in the target. Verdict: not_affected per Rule 5 Type A2 (input received but chain to Goal broken by missing JSON generation).",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2022-45143"
      },
      "impact_statement": "CVE-2022-45143 affects JsonErrorReportValve, which does not exist in Tomcat 8.5.78. The vulnerability involves missing JSON escaping in type/message/description fields. The target version only has ErrorReportValve, which generates HTML error reports with proper HTML escaping (Escape.htmlElementContent). JsonErrorReportValve was introduced upstream on 2020-10-14 in versions 8.5.83+, 9.0.40+, and 10.1.0+, never backported to 8.5.78. The attack chain (user-provided error data \u2192 manipulated JSON output) cannot complete because JSON error reporting does not exist in the target. Verdict: not_affected per Rule 5 Type A2 (input received but chain to Goal broken by missing JSON generation)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T21:11:34.688190+00:00",
      "status_notes": "Vulnerability CVE-2023-24998 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper.",
      "vulnerability": {
        "name": "CVE-2023-24998"
      },
      "action_statement": "Vulnerability CVE-2023-24998 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2023-41080 is fixed in version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper.",
      "vulnerability": {
        "name": "CVE-2023-41080"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2023-42795 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper.",
      "vulnerability": {
        "name": "CVE-2023-42795"
      },
      "action_statement": "Vulnerability CVE-2023-42795 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2023-44487 is fixed in version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper.",
      "vulnerability": {
        "name": "CVE-2023-44487"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2023-45648 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper.",
      "vulnerability": {
        "name": "CVE-2023-45648"
      },
      "action_statement": "Vulnerability CVE-2023-45648 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2023-46589 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper.",
      "vulnerability": {
        "name": "CVE-2023-46589"
      },
      "action_statement": "Vulnerability CVE-2023-46589 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:49:59.024011+00:00",
      "status_notes": "Vulnerability CVE-2024-21733 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper.",
      "vulnerability": {
        "name": "CVE-2024-21733"
      },
      "action_statement": "Vulnerability CVE-2024-21733 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2024-24549 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper.",
      "vulnerability": {
        "name": "CVE-2024-24549"
      },
      "action_statement": "Vulnerability CVE-2024-24549 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2024-34750 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper.",
      "vulnerability": {
        "name": "CVE-2024-34750"
      },
      "action_statement": "Vulnerability CVE-2024-34750 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T10:08:45.693342+00:00",
      "status_notes": "Vulnerability CVE-2024-38286 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper, and is fixed in 8.5.78-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2024-38286"
      },
      "action_statement": "Vulnerability CVE-2024-38286 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper, and is fixed in 8.5.78-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2024-50379 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper.",
      "vulnerability": {
        "name": "CVE-2024-50379"
      },
      "action_statement": "Vulnerability CVE-2024-50379 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:49:59.024011+00:00",
      "status_notes": "Vulnerability CVE-2024-56337 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper.",
      "vulnerability": {
        "name": "CVE-2024-56337"
      },
      "action_statement": "Vulnerability CVE-2024-56337 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2025-24813 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper.",
      "vulnerability": {
        "name": "CVE-2025-24813"
      },
      "action_statement": "Vulnerability CVE-2025-24813 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2025-31650 does not affect version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper. Apache Tomcat 8.5.78 is NOT AFFECTED by CVE-2025-31650. This vulnerability requires RFC 9218 HTTP Extensible Priorities support, which was not introduced until version 8.5.90. Version 8.5.78 lacks the Priority class, PRIORITY_UPDATE frame type, readPriorityUpdateFrame() method, and all priority header parsing code that contains the vulnerability. The CVE's affected version range (8.5.90-8.5.100) correctly excludes 8.5.78.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-31650"
      },
      "impact_statement": "Apache Tomcat 8.5.78 is NOT AFFECTED by CVE-2025-31650. This vulnerability requires RFC 9218 HTTP Extensible Priorities support, which was not introduced until version 8.5.90. Version 8.5.78 lacks the Priority class, PRIORITY_UPDATE frame type, readPriorityUpdateFrame() method, and all priority header parsing code that contains the vulnerability. The CVE's affected version range (8.5.90-8.5.100) correctly excludes 8.5.78."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2025-31651 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper.",
      "vulnerability": {
        "name": "CVE-2025-31651"
      },
      "action_statement": "Vulnerability CVE-2025-31651 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2025-46701 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper.",
      "vulnerability": {
        "name": "CVE-2025-46701"
      },
      "action_statement": "Vulnerability CVE-2025-46701 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2025-48988 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper.",
      "vulnerability": {
        "name": "CVE-2025-48988"
      },
      "action_statement": "Vulnerability CVE-2025-48988 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T18:11:36.374923+00:00",
      "status_notes": "Vulnerability CVE-2025-48989 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper.",
      "vulnerability": {
        "name": "CVE-2025-48989"
      },
      "action_statement": "Vulnerability CVE-2025-48989 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T18:12:53.572239+00:00",
      "status_notes": "Vulnerability CVE-2025-49124 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper.",
      "vulnerability": {
        "name": "CVE-2025-49124"
      },
      "action_statement": "Vulnerability CVE-2025-49124 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2025-49125 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper.",
      "vulnerability": {
        "name": "CVE-2025-49125"
      },
      "action_statement": "Vulnerability CVE-2025-49125 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T10:08:45.693342+00:00",
      "status_notes": "Vulnerability CVE-2025-52434 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper, and is fixed in 8.5.78-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2025-52434"
      },
      "action_statement": "Vulnerability CVE-2025-52434 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper, and is fixed in 8.5.78-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2025-52520 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper.",
      "vulnerability": {
        "name": "CVE-2025-52520"
      },
      "action_statement": "Vulnerability CVE-2025-52520 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2025-53506 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper.",
      "vulnerability": {
        "name": "CVE-2025-53506"
      },
      "action_statement": "Vulnerability CVE-2025-53506 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T18:12:53.572239+00:00",
      "status_notes": "Vulnerability CVE-2025-55668 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper.",
      "vulnerability": {
        "name": "CVE-2025-55668"
      },
      "action_statement": "Vulnerability CVE-2025-55668 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2025-55752 is fixed in version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper.",
      "vulnerability": {
        "name": "CVE-2025-55752"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2025-55754 is fixed in version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper.",
      "vulnerability": {
        "name": "CVE-2025-55754"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2025-61795 is fixed in version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper.",
      "vulnerability": {
        "name": "CVE-2025-61795"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2025-66614 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper.",
      "vulnerability": {
        "name": "CVE-2025-66614"
      },
      "action_statement": "Vulnerability CVE-2025-66614 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T10:58:34.392596+00:00",
      "status_notes": "Vulnerability CVE-2026-24734 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper.",
      "vulnerability": {
        "name": "CVE-2026-24734"
      },
      "action_statement": "Vulnerability CVE-2026-24734 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2026-24880 is fixed in version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper.",
      "vulnerability": {
        "name": "CVE-2026-24880"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2026-25854 is fixed in version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper.",
      "vulnerability": {
        "name": "CVE-2026-25854"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T18:12:53.572239+00:00",
      "status_notes": "Vulnerability CVE-2026-34483 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper.",
      "vulnerability": {
        "name": "CVE-2026-34483"
      },
      "action_statement": "Vulnerability CVE-2026-34483 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T18:11:01.360398+00:00",
      "status_notes": "Vulnerability CVE-2026-34487 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper.",
      "vulnerability": {
        "name": "CVE-2026-34487"
      },
      "action_statement": "Vulnerability CVE-2026-34487 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2026-41284 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper.",
      "vulnerability": {
        "name": "CVE-2026-41284"
      },
      "action_statement": "Vulnerability CVE-2026-41284 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2026-41293 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper.",
      "vulnerability": {
        "name": "CVE-2026-41293"
      },
      "action_statement": "Vulnerability CVE-2026-41293 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2026-42498 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper.",
      "vulnerability": {
        "name": "CVE-2026-42498"
      },
      "action_statement": "Vulnerability CVE-2026-42498 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2026-43512 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper.",
      "vulnerability": {
        "name": "CVE-2026-43512"
      },
      "action_statement": "Vulnerability CVE-2026-43512 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2026-43513 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper.",
      "vulnerability": {
        "name": "CVE-2026-43513"
      },
      "action_statement": "Vulnerability CVE-2026-43513 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2026-43514 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper.",
      "vulnerability": {
        "name": "CVE-2026-43514"
      },
      "action_statement": "Vulnerability CVE-2026-43514 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2026-43515 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper.",
      "vulnerability": {
        "name": "CVE-2026-43515"
      },
      "action_statement": "Vulnerability CVE-2026-43515 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2026-65182 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper.",
      "vulnerability": {
        "name": "CVE-2026-65182"
      },
      "action_statement": "Vulnerability CVE-2026-65182 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2026-65905 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper.",
      "vulnerability": {
        "name": "CVE-2026-65905"
      },
      "action_statement": "Vulnerability CVE-2026-65905 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@8.5.78-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T13:38:00.476789+00:00",
      "status_notes": "Vulnerability CVE-2026-68525 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper.",
      "vulnerability": {
        "name": "CVE-2026-68525"
      },
      "action_statement": "Vulnerability CVE-2026-68525 affects version 8.5.78-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper."
    }
  ]
}