{ "@id": "urn:uuid:0cb9a204-a65c-4070-a20d-212d22626cc5", "role": "Document Creator", "author": "https://tuxcare.com", "version": 41, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-10-30T15:44:00.110412+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-28T23:37:14.382670+00:00", "status_notes": "Vulnerability CVE-2017-12615 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket.", "vulnerability": { "name": "CVE-2017-12615" }, "action_statement": "Vulnerability CVE-2017-12615 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-28T23:28:44.006786+00:00", "status_notes": "Vulnerability CVE-2017-12617 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket.", "vulnerability": { "name": "CVE-2017-12617" }, "action_statement": "Vulnerability CVE-2017-12617 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-30T14:57:45.485772+00:00", "status_notes": "Vulnerability CVE-2017-5648 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket.", "vulnerability": { "name": "CVE-2017-5648" }, "action_statement": "Vulnerability CVE-2017-5648 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-30T14:57:45.485772+00:00", "status_notes": "Vulnerability CVE-2018-11784 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket.", "vulnerability": { "name": "CVE-2018-11784" }, "action_statement": "Vulnerability CVE-2018-11784 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-30T14:57:45.485772+00:00", "status_notes": "Vulnerability CVE-2018-1304 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket.", "vulnerability": { "name": "CVE-2018-1304" }, "action_statement": "Vulnerability CVE-2018-1304 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-30T14:57:45.485772+00:00", "status_notes": "Vulnerability CVE-2018-1305 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket.", "vulnerability": { "name": "CVE-2018-1305" }, "action_statement": "Vulnerability CVE-2018-1305 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-30T14:57:45.485772+00:00", "status_notes": "Vulnerability CVE-2018-1336 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket.", "vulnerability": { "name": "CVE-2018-1336" }, "action_statement": "Vulnerability CVE-2018-1336 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-30T14:57:45.485772+00:00", "status_notes": "Vulnerability CVE-2018-8014 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket.", "vulnerability": { "name": "CVE-2018-8014" }, "action_statement": "Vulnerability CVE-2018-8014 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-30T14:57:45.485772+00:00", "status_notes": "Vulnerability CVE-2018-8034 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket.", "vulnerability": { "name": "CVE-2018-8034" }, "action_statement": "Vulnerability CVE-2018-8034 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-30T15:44:00.110412+00:00", "status_notes": "Vulnerability CVE-2018-8037 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket.", "vulnerability": { "name": "CVE-2018-8037" }, "action_statement": "Vulnerability CVE-2018-8037 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-30T14:57:45.485772+00:00", "status_notes": "Vulnerability CVE-2019-0199 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket.", "vulnerability": { "name": "CVE-2019-0199" }, "action_statement": "Vulnerability CVE-2019-0199 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-30T14:57:45.485772+00:00", "status_notes": "Vulnerability CVE-2019-0221 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket.", "vulnerability": { "name": "CVE-2019-0221" }, "action_statement": "Vulnerability CVE-2019-0221 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-30T14:57:45.485772+00:00", "status_notes": "Vulnerability CVE-2019-0232 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket.", "vulnerability": { "name": "CVE-2019-0232" }, "action_statement": "Vulnerability CVE-2019-0232 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-30T15:44:00.110412+00:00", "status_notes": "Vulnerability CVE-2019-10072 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket.", "vulnerability": { "name": "CVE-2019-10072" }, "action_statement": "Vulnerability CVE-2019-10072 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-30T14:57:45.485772+00:00", "status_notes": "Vulnerability CVE-2019-12418 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket.", "vulnerability": { "name": "CVE-2019-12418" }, "action_statement": "Vulnerability CVE-2019-12418 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-28T23:28:44.006786+00:00", "status_notes": "Vulnerability CVE-2019-17563 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket.", "vulnerability": { "name": "CVE-2019-17563" }, "action_statement": "Vulnerability CVE-2019-17563 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-28T23:49:59.024011+00:00", "status_notes": "Vulnerability CVE-2020-11996 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket.", "vulnerability": { "name": "CVE-2020-11996" }, "action_statement": "Vulnerability CVE-2020-11996 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-28T23:49:59.024011+00:00", "status_notes": "Vulnerability CVE-2020-13935 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket.", "vulnerability": { "name": "CVE-2020-13935" }, "action_statement": "Vulnerability CVE-2020-13935 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-28T23:28:44.006786+00:00", "status_notes": "Vulnerability CVE-2020-1935 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket.", "vulnerability": { "name": "CVE-2020-1935" }, "action_statement": "Vulnerability CVE-2020-1935 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-30T14:57:45.485772+00:00", "status_notes": "Vulnerability CVE-2020-1938 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket.", "vulnerability": { "name": "CVE-2020-1938" }, "action_statement": "Vulnerability CVE-2020-1938 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-28T23:28:44.006786+00:00", "status_notes": "Vulnerability CVE-2020-9484 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket.", "vulnerability": { "name": "CVE-2020-9484" }, "action_statement": "Vulnerability CVE-2020-9484 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-28T23:33:09.807961+00:00", "status_notes": "Vulnerability CVE-2021-24122 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket.", "vulnerability": { "name": "CVE-2021-24122" }, "action_statement": "Vulnerability CVE-2021-24122 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-30T15:44:00.110412+00:00", "status_notes": "Vulnerability CVE-2021-25122 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket.", "vulnerability": { "name": "CVE-2021-25122" }, "action_statement": "Vulnerability CVE-2021-25122 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-28T23:28:44.006786+00:00", "status_notes": "Vulnerability CVE-2021-25329 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket.", "vulnerability": { "name": "CVE-2021-25329" }, "action_statement": "Vulnerability CVE-2021-25329 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-28T21:12:12.887949+00:00", "status_notes": "Vulnerability CVE-2022-42252 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket.", "vulnerability": { "name": "CVE-2022-42252" }, "action_statement": "Vulnerability CVE-2022-42252 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-28T21:05:01.196083+00:00", "status_notes": "Vulnerability CVE-2022-45143 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket.", "vulnerability": { "name": "CVE-2022-45143" }, "action_statement": "Vulnerability CVE-2022-45143 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-28T21:11:34.688190+00:00", "status_notes": "Vulnerability CVE-2023-24998 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket.", "vulnerability": { "name": "CVE-2023-24998" }, "action_statement": "Vulnerability CVE-2023-24998 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-30T00:55:03.593528+00:00", "status_notes": "Vulnerability CVE-2023-41080 does not affect version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket. not_affected \u2014 CVE-2023-41080 (Open Redirect via protocol-relative URLs in FORM authentication) is NOT present in this target. The fix that prevents protocol-relative redirects by removing leading forward slashes from redirect URLs was already included in the upstream Apache Tomcat 10.1.13 release (commit bb4624a9f3e by Mark Thomas, 2023-08-22). Since TuxCare onboarded version 10.1.55 (much later than 10.1.13...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-41080" }, "impact_statement": "not_affected \u2014 CVE-2023-41080 (Open Redirect via protocol-relative URLs in FORM authentication) is NOT present in this target. The fix that prevents protocol-relative redirects by removing leading forward slashes from redirect URLs was already included in the upstream Apache Tomcat 10.1.13 release (commit bb4624a9f3e by Mark Thomas, 2023-08-22). Since TuxCare onboarded version 10.1.55 (much later than 10.1.13..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-28T18:27:36.115719+00:00", "status_notes": "Vulnerability CVE-2023-42795 does not affect version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket. not_affected \u2014 CVE-2023-42795 (Incomplete Cleanup vulnerability) is not present in Tomcat 10.1.55. The upstream fix by Mark Thomas (commit 9375d67106) was included in the Apache Tomcat 10.1.55 release that TuxCare onboarded. All required defensive changes are present: try-catch blocks in recycle() methods for Request.java, ApplicationHttpRequest.java, B2CConverter.java, and C2BConverter.java ensure cleanup co...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-42795" }, "impact_statement": "not_affected \u2014 CVE-2023-42795 (Incomplete Cleanup vulnerability) is not present in Tomcat 10.1.55. The upstream fix by Mark Thomas (commit 9375d67106) was included in the Apache Tomcat 10.1.55 release that TuxCare onboarded. All required defensive changes are present: try-catch blocks in recycle() methods for Request.java, ApplicationHttpRequest.java, B2CConverter.java, and C2BConverter.java ensure cleanup co..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-28T18:12:53.572239+00:00", "status_notes": "Vulnerability CVE-2023-44487 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket.", "vulnerability": { "name": "CVE-2023-44487" }, "action_statement": "Vulnerability CVE-2023-44487 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-28T19:11:13.689447+00:00", "status_notes": "Vulnerability CVE-2023-45648 does not affect version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket. not_affected \u2014 CVE-2023-45648 is NOT present in Tomcat 10.1.55. The vulnerability (improper HTTP trailer header parsing allowing request smuggling) was fixed in the upstream release before TuxCare onboarded it. Tomcat 10.1.55 uses HttpHeaderParser class for trailer parsing, which includes built-in validation that rejects non-token characters in header names (line 141-148) and control characters except tab in ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-45648" }, "impact_statement": "not_affected \u2014 CVE-2023-45648 is NOT present in Tomcat 10.1.55. The vulnerability (improper HTTP trailer header parsing allowing request smuggling) was fixed in the upstream release before TuxCare onboarded it. Tomcat 10.1.55 uses HttpHeaderParser class for trailer parsing, which includes built-in validation that rejects non-token characters in header names (line 141-148) and control characters except tab in ..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability CVE-2023-46589 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket.", "vulnerability": { "name": "CVE-2023-46589" }, "action_statement": "Vulnerability CVE-2023-46589 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-28T23:49:59.024011+00:00", "status_notes": "Vulnerability CVE-2024-21733 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket.", "vulnerability": { "name": "CVE-2024-21733" }, "action_statement": "Vulnerability CVE-2024-21733 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-26T10:52:26.710047+00:00", "status_notes": "Vulnerability CVE-2024-23672 does not affect version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket. not_affected \u2014 Apache Tomcat 10.1.55 is NOT affected by CVE-2024-23672. The vulnerability (incomplete WebSocket session cleanup leading to DoS) was fixed in upstream Apache Tomcat 10.1.19 and later versions. The target version 10.1.55 contains the complete fix, which was introduced by upstream commit 0052b37468 (authored by Mark Thomas, markt@apache.org, on 2024-01-18). This fix was already present in the ups...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-23672" }, "impact_statement": "not_affected \u2014 Apache Tomcat 10.1.55 is NOT affected by CVE-2024-23672. The vulnerability (incomplete WebSocket session cleanup leading to DoS) was fixed in upstream Apache Tomcat 10.1.19 and later versions. The target version 10.1.55 contains the complete fix, which was introduced by upstream commit 0052b37468 (authored by Mark Thomas, markt@apache.org, on 2024-01-18). This fix was already present in the ups..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-26T10:52:26.710047+00:00", "status_notes": "Vulnerability CVE-2024-24549 does not affect version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket. The target Apache Tomcat 10.1.55 is NOT vulnerable to CVE-2024-24549. The vulnerability was fixed in upstream Tomcat 10.1.19 (released 2024-02-19), and version 10.1.55 includes this fix. The fix moves HTTP/2 header validation to occur after each frame (HEADERS and CONTINUATION) rather than delaying until all headers are complete, preventing resource exhaustion from oversized headers. The fix commit (d07c82194e by markt@apache.org) is present in the target's git history and was part of the upstream release onboarded by TuxCare.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-24549" }, "impact_statement": "The target Apache Tomcat 10.1.55 is NOT vulnerable to CVE-2024-24549. The vulnerability was fixed in upstream Tomcat 10.1.19 (released 2024-02-19), and version 10.1.55 includes this fix. The fix moves HTTP/2 header validation to occur after each frame (HEADERS and CONTINUATION) rather than delaying until all headers are complete, preventing resource exhaustion from oversized headers. The fix commit (d07c82194e by markt@apache.org) is present in the target's git history and was part of the upstream release onboarded by TuxCare." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-28T18:12:53.572239+00:00", "status_notes": "Vulnerability CVE-2024-34750 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket.", "vulnerability": { "name": "CVE-2024-34750" }, "action_statement": "Vulnerability CVE-2024-34750 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-28T18:12:53.572239+00:00", "status_notes": "Vulnerability CVE-2024-38286 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket.", "vulnerability": { "name": "CVE-2024-38286" }, "action_statement": "Vulnerability CVE-2024-38286 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-28T18:11:36.374923+00:00", "status_notes": "Vulnerability CVE-2024-50379 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket.", "vulnerability": { "name": "CVE-2024-50379" }, "action_statement": "Vulnerability CVE-2024-50379 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-28T23:49:59.024011+00:00", "status_notes": "Vulnerability CVE-2024-56337 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket.", "vulnerability": { "name": "CVE-2024-56337" }, "action_statement": "Vulnerability CVE-2024-56337 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability CVE-2025-24813 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket.", "vulnerability": { "name": "CVE-2025-24813" }, "action_statement": "Vulnerability CVE-2025-24813 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-28T18:12:53.572239+00:00", "status_notes": "Vulnerability CVE-2025-31650 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket.", "vulnerability": { "name": "CVE-2025-31650" }, "action_statement": "Vulnerability CVE-2025-31650 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-28T18:12:53.572239+00:00", "status_notes": "Vulnerability CVE-2025-31651 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket.", "vulnerability": { "name": "CVE-2025-31651" }, "action_statement": "Vulnerability CVE-2025-31651 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability CVE-2025-46701 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket.", "vulnerability": { "name": "CVE-2025-46701" }, "action_statement": "Vulnerability CVE-2025-46701 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-26T10:52:26.710047+00:00", "status_notes": "Vulnerability CVE-2025-48988 does not affect version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket. CVE-2025-48988 affects Apache Tomcat 10.1.0-M1 through 10.1.41 and was fixed in 10.1.42. The target repository is version 10.1.55, which already contains the upstream fix (commit cdde8e655b by Apache developer Mark Thomas). The fix adds two resource limits for multipart/form-data requests: maxPartCount (default 50) and maxPartHeaderSize (default 512 bytes), preventing unbounded resource allocation. These limits are enforced in Request.parseParts() via Apache Commons FileUpload. The fix was part of the upstream Apache Tomcat 10.1.55 release that TuxCare onboarded, not a separate TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-48988" }, "impact_statement": "CVE-2025-48988 affects Apache Tomcat 10.1.0-M1 through 10.1.41 and was fixed in 10.1.42. The target repository is version 10.1.55, which already contains the upstream fix (commit cdde8e655b by Apache developer Mark Thomas). The fix adds two resource limits for multipart/form-data requests: maxPartCount (default 50) and maxPartHeaderSize (default 512 bytes), preventing unbounded resource allocation. These limits are enforced in Request.parseParts() via Apache Commons FileUpload. The fix was part of the upstream Apache Tomcat 10.1.55 release that TuxCare onboarded, not a separate TuxCare backport." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-28T18:11:36.374923+00:00", "status_notes": "Vulnerability CVE-2025-48989 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket.", "vulnerability": { "name": "CVE-2025-48989" }, "action_statement": "Vulnerability CVE-2025-48989 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-28T18:12:53.572239+00:00", "status_notes": "Vulnerability CVE-2025-49124 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket.", "vulnerability": { "name": "CVE-2025-49124" }, "action_statement": "Vulnerability CVE-2025-49124 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-26T10:52:26.710047+00:00", "status_notes": "Vulnerability CVE-2025-49125 does not affect version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket. Apache Tomcat 10.1.55 is not affected by CVE-2025-49125. The vulnerability was fixed in upstream version 10.1.42, and version 10.1.55 already contains the fix. The fix introduces an isPathMounted() method that validates the character following the mount point prefix is either end-of-string or a '/' separator, preventing prefix-collision attacks on PreResources and PostResources. This is an upstream fix authored by Mark Thomas (markt@apache.org) that shipped in the upstream release onboarded by TuxCare.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-49125" }, "impact_statement": "Apache Tomcat 10.1.55 is not affected by CVE-2025-49125. The vulnerability was fixed in upstream version 10.1.42, and version 10.1.55 already contains the fix. The fix introduces an isPathMounted() method that validates the character following the mount point prefix is either end-of-string or a '/' separator, preventing prefix-collision attacks on PreResources and PostResources. This is an upstream fix authored by Mark Thomas (markt@apache.org) that shipped in the upstream release onboarded by TuxCare." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability CVE-2025-52434 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket.", "vulnerability": { "name": "CVE-2025-52434" }, "action_statement": "Vulnerability CVE-2025-52434 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability CVE-2025-52520 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket.", "vulnerability": { "name": "CVE-2025-52520" }, "action_statement": "Vulnerability CVE-2025-52520 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-28T18:12:53.572239+00:00", "status_notes": "Vulnerability CVE-2025-53506 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket.", "vulnerability": { "name": "CVE-2025-53506" }, "action_statement": "Vulnerability CVE-2025-53506 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-28T20:42:04.886450+00:00", "status_notes": "Vulnerability CVE-2025-55668 does not affect version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket. not_affected \u2014 Target version 10.1.55 is not affected by CVE-2025-55668. The session fixation vulnerability in the rewrite valve was fixed in upstream Apache Tomcat 10.1.42, and version 10.1.55 ships with this fix already applied. Both critical defense mechanisms are present: (1) redirect URLs are properly encoded with session IDs via response.encodeRedirectURL() at line 474, and (2) session information is re...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-55668" }, "impact_statement": "not_affected \u2014 Target version 10.1.55 is not affected by CVE-2025-55668. The session fixation vulnerability in the rewrite valve was fixed in upstream Apache Tomcat 10.1.42, and version 10.1.55 ships with this fix already applied. Both critical defense mechanisms are present: (1) redirect URLs are properly encoded with session IDs via response.encodeRedirectURL() at line 474, and (2) session information is re..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-28T18:12:53.572239+00:00", "status_notes": "Vulnerability CVE-2025-55752 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket.", "vulnerability": { "name": "CVE-2025-55752" }, "action_statement": "Vulnerability CVE-2025-55752 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-28T18:11:01.360398+00:00", "status_notes": "Vulnerability CVE-2025-55754 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket.", "vulnerability": { "name": "CVE-2025-55754" }, "action_statement": "Vulnerability CVE-2025-55754 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-28T19:18:45.160348+00:00", "status_notes": "Vulnerability CVE-2025-61795 does not affect version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket. not_affected \u2014 Target version 10.1.55 already contains the upstream fix for CVE-2025-61795. The vulnerable pattern (missing immediate cleanup of temporary files after failed multipart uploads) is not present. The fix (commit af6e9181 by Mark Thomas) was shipped in Apache Tomcat's upstream 10.1.55 release, which TuxCare subsequently onboarded. The fix adds explicit `item.delete()` cleanup in a finally block wh...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-61795" }, "impact_statement": "not_affected \u2014 Target version 10.1.55 already contains the upstream fix for CVE-2025-61795. The vulnerable pattern (missing immediate cleanup of temporary files after failed multipart uploads) is not present. The fix (commit af6e9181 by Mark Thomas) was shipped in Apache Tomcat's upstream 10.1.55 release, which TuxCare subsequently onboarded. The fix adds explicit `item.delete()` cleanup in a finally block wh..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-28T18:11:01.360398+00:00", "status_notes": "Vulnerability CVE-2025-66614 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket.", "vulnerability": { "name": "CVE-2025-66614" }, "action_statement": "Vulnerability CVE-2025-66614 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-30T10:58:34.392596+00:00", "status_notes": "Vulnerability CVE-2026-24734 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket.", "vulnerability": { "name": "CVE-2026-24734" }, "action_statement": "Vulnerability CVE-2026-24734 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-26T10:52:26.710047+00:00", "status_notes": "Vulnerability CVE-2026-24880 does not affect version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket. CVE-2026-24880 (HTTP Request Smuggling via invalid chunk extension) is NOT present in Tomcat 10.1.55. The vulnerability required proper validation of chunk extension syntax to prevent inconsistent interpretation between HTTP processors. The upstream fix (commits f07df938d0 and 1e71441a15 by Mark Thomas) introduced a ChunkExtension.parse() state machine parser that validates chunk extensions according to RFC specifications. This fix was already included in the upstream Apache Tomcat 10.1.55 release, which TuxCare subsequently onboarded. The target code contains the complete fix: ChunkExtension.java with the state machine parser exists, and ChunkedInputFilter.java correctly uses ChunkExtension.parse() to validate all chunk extensions in both parseChunkHeader() and skipChunkHeader() methods.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-24880" }, "impact_statement": "CVE-2026-24880 (HTTP Request Smuggling via invalid chunk extension) is NOT present in Tomcat 10.1.55. The vulnerability required proper validation of chunk extension syntax to prevent inconsistent interpretation between HTTP processors. The upstream fix (commits f07df938d0 and 1e71441a15 by Mark Thomas) introduced a ChunkExtension.parse() state machine parser that validates chunk extensions according to RFC specifications. This fix was already included in the upstream Apache Tomcat 10.1.55 release, which TuxCare subsequently onboarded. The target code contains the complete fix: ChunkExtension.java with the state machine parser exists, and ChunkedInputFilter.java correctly uses ChunkExtension.parse() to validate all chunk extensions in both parseChunkHeader() and skipChunkHeader() methods." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-28T20:05:05.196840+00:00", "status_notes": "Vulnerability CVE-2026-25854 does not affect version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket. not_affected \u2014 The target repository (Apache Tomcat 10.1.55) is NOT AFFECTED by CVE-2026-25854. The vulnerability involves an open redirect via LoadBalancerDrainingValve when multiple leading slashes in URIs create protocol-relative URLs. Both required fixes are present in the target: (1) collapseLeadingSlashes() sanitizes URIs at line 211, and (2) sendRedirect() provides validated redirects at line 226. Thes...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25854" }, "impact_statement": "not_affected \u2014 The target repository (Apache Tomcat 10.1.55) is NOT AFFECTED by CVE-2026-25854. The vulnerability involves an open redirect via LoadBalancerDrainingValve when multiple leading slashes in URIs create protocol-relative URLs. Both required fixes are present in the target: (1) collapseLeadingSlashes() sanitizes URIs at line 211, and (2) sendRedirect() provides validated redirects at line 226. Thes..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-28T18:12:53.572239+00:00", "status_notes": "Vulnerability CVE-2026-34483 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket.", "vulnerability": { "name": "CVE-2026-34483" }, "action_statement": "Vulnerability CVE-2026-34483 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-28T18:11:01.360398+00:00", "status_notes": "Vulnerability CVE-2026-34487 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket.", "vulnerability": { "name": "CVE-2026-34487" }, "action_statement": "Vulnerability CVE-2026-34487 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-28T18:11:36.374923+00:00", "status_notes": "Vulnerability CVE-2026-41284 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket.", "vulnerability": { "name": "CVE-2026-41284" }, "action_statement": "Vulnerability CVE-2026-41284 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-28T18:11:01.360398+00:00", "status_notes": "Vulnerability CVE-2026-41293 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket.", "vulnerability": { "name": "CVE-2026-41293" }, "action_statement": "Vulnerability CVE-2026-41293 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-28T18:11:01.360398+00:00", "status_notes": "Vulnerability CVE-2026-42498 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket.", "vulnerability": { "name": "CVE-2026-42498" }, "action_statement": "Vulnerability CVE-2026-42498 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability CVE-2026-43512 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket.", "vulnerability": { "name": "CVE-2026-43512" }, "action_statement": "Vulnerability CVE-2026-43512 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-28T18:11:36.374923+00:00", "status_notes": "Vulnerability CVE-2026-43513 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket.", "vulnerability": { "name": "CVE-2026-43513" }, "action_statement": "Vulnerability CVE-2026-43513 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-28T20:00:39.237106+00:00", "status_notes": "Vulnerability CVE-2026-43514 does not affect version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket. not_affected \u2014 CVE-2026-43514 (AJP secret timing attack) is NOT present in the target. The vulnerable non-constant-time secret comparison was replaced with constant-time comparison in upstream Apache Tomcat 10.1.55. The fix (commit a102a2a157 by markt@apache.org) shipped in the upstream release before TuxCare onboarded it. The target code at java/org/apache/coyote/ajp/AjpProcessor.java:840 uses ConstantTime.e...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-43514" }, "impact_statement": "not_affected \u2014 CVE-2026-43514 (AJP secret timing attack) is NOT present in the target. The vulnerable non-constant-time secret comparison was replaced with constant-time comparison in upstream Apache Tomcat 10.1.55. The fix (commit a102a2a157 by markt@apache.org) shipped in the upstream release before TuxCare onboarded it. The target code at java/org/apache/coyote/ajp/AjpProcessor.java:840 uses ConstantTime.e..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-28T18:12:53.572239+00:00", "status_notes": "Vulnerability CVE-2026-43515 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket.", "vulnerability": { "name": "CVE-2026-43515" }, "action_statement": "Vulnerability CVE-2026-43515 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-26T10:52:26.710047+00:00", "status_notes": "Vulnerability CVE-2026-65182 is fixed in version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket.", "vulnerability": { "name": "CVE-2026-65182" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-27T14:53:31.015773+00:00", "status_notes": "Vulnerability CVE-2026-65637 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket.", "vulnerability": { "name": "CVE-2026-65637" }, "action_statement": "Vulnerability CVE-2026-65637 affects version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-26T10:52:26.710047+00:00", "status_notes": "Vulnerability CVE-2026-65905 is fixed in version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket.", "vulnerability": { "name": "CVE-2026-65905" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.55-tuxcare.1" } } ], "timestamp": "2026-10-26T10:52:33.167508+00:00", "status_notes": "Vulnerability CVE-2026-68525 is fixed in version 10.1.55-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket.", "vulnerability": { "name": "CVE-2026-68525" } } ] }