{
  "@id": "urn:uuid:8b8deea0-033d-4749-ba4a-c0673611ddbf",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 35,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-30T15:44:00.110412+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-28T23:41:42.084809+00:00",
      "status_notes": "Vulnerability CVE-2017-12615 affects version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket.",
      "vulnerability": {
        "name": "CVE-2017-12615"
      },
      "action_statement": "Vulnerability CVE-2017-12615 affects version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2017-12617 does not affect version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket. already_fixed \u2014 CVE-2017-12617 has been fixed in the target repository. Both required patches preventing JSP upload via crafted HTTP PUT requests with trailing slashes are present in the codebase.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-12617"
      },
      "impact_statement": "already_fixed \u2014 CVE-2017-12617 has been fixed in the target repository. Both required patches preventing JSP upload via crafted HTTP PUT requests with trailing slashes are present in the codebase."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-30T15:44:00.110412+00:00",
      "status_notes": "Vulnerability CVE-2017-5648 does not affect version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket. CVE-2017-5648 affects Apache Tomcat 8.5.0-8.5.11",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-5648"
      },
      "impact_statement": "CVE-2017-5648 affects Apache Tomcat 8.5.0-8.5.11"
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-30T15:44:00.110412+00:00",
      "status_notes": "Vulnerability CVE-2018-11784 affects version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket.",
      "vulnerability": {
        "name": "CVE-2018-11784"
      },
      "action_statement": "Vulnerability CVE-2018-11784 affects version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-30T15:44:00.110412+00:00",
      "status_notes": "Vulnerability CVE-2018-1304 does not affect version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket. already_fixed \u2014 CVE-2018-1304 affects Apache Tomcat 8.5.0 to 8.5.27 where security constraints with URL pattern \"\" (empty string) were not correctly handled, causing them to be ignored. The target repository is version 8.5.100-tuxcare.10, which is much newer than the affected range. The fix was incorporated into upstream Tomcat 8.5.28 on February 6, 2018 via commit 5af7c13cff. The fix is present in the current codebase at RealmBase.java line 577, which explicitly handles empty string patterns by treating them as matching the context root ('/').",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1304"
      },
      "impact_statement": "already_fixed \u2014 CVE-2018-1304 affects Apache Tomcat 8.5.0 to 8.5.27 where security constraints with URL pattern \"\" (empty string) were not correctly handled, causing them to be ignored. The target repository is version 8.5.100-tuxcare.10, which is much newer than the affected range. The fix was incorporated into upstream Tomcat 8.5.28 on February 6, 2018 via commit 5af7c13cff. The fix is present in the current codebase at RealmBase.java line 577, which explicitly handles empty string patterns by treating them as matching the context root ('/')."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-30T15:44:00.110412+00:00",
      "status_notes": "Vulnerability CVE-2018-1305 does not affect version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket. Version 8.5.100 is not vulnerable. Summary: CVE-2018-1305 is NOT present in the target repository. The vulnerable code pattern (lazy ServletSecurity annotation scanning) has been replaced with the fix (ServletSecurity annotations processed at web application startup). Target version 8.5.100 is newer than the affected range (8.5.0 to 8.5.27) and contains the fix applied in version 8.5.28.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1305"
      },
      "impact_statement": "Version 8.5.100 is not vulnerable. Summary: CVE-2018-1305 is NOT present in the target repository. The vulnerable code pattern (lazy ServletSecurity annotation scanning) has been replaced with the fix (ServletSecurity annotations processed at web application startup). Target version 8.5.100 is newer than the affected range (8.5.0 to 8.5.27) and contains the fix applied in version 8.5.28."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-30T15:44:00.110412+00:00",
      "status_notes": "Vulnerability CVE-2018-1336 does not affect version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket. already_fixed \u2014 CVE-2018-1336 has been fixed in Tomcat 8.5.100. The vulnerability involving improper overflow handling in the UTF-8 decoder with supplementary characters was addressed in version 8.5.31 (commit e00812b94e, April 27, 2018). The fix is present in the primary decoding path (decodeHasArray method, lines 270-275), which handles array-backed buffers - the common case in Tomcat's usage.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1336"
      },
      "impact_statement": "already_fixed \u2014 CVE-2018-1336 has been fixed in Tomcat 8.5.100. The vulnerability involving improper overflow handling in the UTF-8 decoder with supplementary characters was addressed in version 8.5.31 (commit e00812b94e, April 27, 2018). The fix is present in the primary decoding path (decodeHasArray method, lines 270-275), which handles array-backed buffers - the common case in Tomcat's usage."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-30T15:44:00.110412+00:00",
      "status_notes": "Vulnerability CVE-2018-8014 does not affect version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket. Tomcat Version 8.5.100 is not vulnerable to CVE-2018-8014. Confirmed by manual code inspection and security advisories.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-8014"
      },
      "impact_statement": "Tomcat Version 8.5.100 is not vulnerable to CVE-2018-8014. Confirmed by manual code inspection and security advisories."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-30T15:44:00.110412+00:00",
      "status_notes": "Vulnerability CVE-2018-8034 does not affect version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket. Tomcat Version 8.5.100 is not vulnerable to CVE-2018-8034. Confirmed by manual code inspection and security advisories.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-8034"
      },
      "impact_statement": "Tomcat Version 8.5.100 is not vulnerable to CVE-2018-8034. Confirmed by manual code inspection and security advisories."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-30T15:44:00.110412+00:00",
      "status_notes": "Vulnerability CVE-2018-8037 affects version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket.",
      "vulnerability": {
        "name": "CVE-2018-8037"
      },
      "action_statement": "Vulnerability CVE-2018-8037 affects version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-30T15:44:00.110412+00:00",
      "status_notes": "Vulnerability CVE-2019-0199 affects version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket.",
      "vulnerability": {
        "name": "CVE-2019-0199"
      },
      "action_statement": "Vulnerability CVE-2019-0199 affects version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-30T15:44:00.110412+00:00",
      "status_notes": "Vulnerability CVE-2019-0221 affects version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket.",
      "vulnerability": {
        "name": "CVE-2019-0221"
      },
      "action_statement": "Vulnerability CVE-2019-0221 affects version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-30T15:44:00.110412+00:00",
      "status_notes": "Vulnerability CVE-2019-0232 affects version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket.",
      "vulnerability": {
        "name": "CVE-2019-0232"
      },
      "action_statement": "Vulnerability CVE-2019-0232 affects version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-30T15:44:00.110412+00:00",
      "status_notes": "Vulnerability CVE-2019-10072 affects version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket.",
      "vulnerability": {
        "name": "CVE-2019-10072"
      },
      "action_statement": "Vulnerability CVE-2019-10072 affects version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-30T15:44:00.110412+00:00",
      "status_notes": "Vulnerability CVE-2019-12418 affects version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket.",
      "vulnerability": {
        "name": "CVE-2019-12418"
      },
      "action_statement": "Vulnerability CVE-2019-12418 affects version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-28T23:28:44.006786+00:00",
      "status_notes": "Vulnerability CVE-2019-17563 affects version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket.",
      "vulnerability": {
        "name": "CVE-2019-17563"
      },
      "action_statement": "Vulnerability CVE-2019-17563 affects version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2020-11996 does not affect version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket. Version 8.5.100 is not vulnerable. Summary: The target repository is NOT vulnerable to CVE-2020-11996. The vulnerability has been fixed with an optimized implementation that uses ConcurrentNavigableMap.subMap() instead of the vulnerable loop pattern. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11996"
      },
      "impact_statement": "Version 8.5.100 is not vulnerable. Summary: The target repository is NOT vulnerable to CVE-2020-11996. The vulnerability has been fixed with an optimized implementation that uses ConcurrentNavigableMap.subMap() instead of the vulnerable loop pattern. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2020-13935 affects version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket.",
      "vulnerability": {
        "name": "CVE-2020-13935"
      },
      "action_statement": "Vulnerability CVE-2020-13935 affects version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-28T23:33:09.807961+00:00",
      "status_notes": "Vulnerability CVE-2020-1935 affects version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket.",
      "vulnerability": {
        "name": "CVE-2020-1935"
      },
      "action_statement": "Vulnerability CVE-2020-1935 affects version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-30T15:44:00.110412+00:00",
      "status_notes": "Vulnerability CVE-2020-1938 affects version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket.",
      "vulnerability": {
        "name": "CVE-2020-1938"
      },
      "action_statement": "Vulnerability CVE-2020-1938 affects version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2020-9484 does not affect version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket. already_fixed \u2014 The target Tomcat 8.5.100 repository already contains the fix for CVE-2020-9484. Path traversal validation was added to FileStore.java to prevent deserialization of attacker-controlled files outside the session storage directory. The fix is present at lines 347-350 using the improved Path API approach from the vendor's later commits.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9484"
      },
      "impact_statement": "already_fixed \u2014 The target Tomcat 8.5.100 repository already contains the fix for CVE-2020-9484. Path traversal validation was added to FileStore.java to prevent deserialization of attacker-controlled files outside the session storage directory. The fix is present at lines 347-350 using the improved Path API approach from the vendor's later commits."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-24122 does not affect version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket. CVE-2021-24122 affects Apache Tomcat 8.5.0-8.5.59",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-24122"
      },
      "impact_statement": "CVE-2021-24122 affects Apache Tomcat 8.5.0-8.5.59"
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-30T15:44:00.110412+00:00",
      "status_notes": "Vulnerability CVE-2021-25122 affects version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket.",
      "vulnerability": {
        "name": "CVE-2021-25122"
      },
      "action_statement": "Vulnerability CVE-2021-25122 affects version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-28T23:33:09.807961+00:00",
      "status_notes": "Vulnerability CVE-2021-25329 affects version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket.",
      "vulnerability": {
        "name": "CVE-2021-25329"
      },
      "action_statement": "Vulnerability CVE-2021-25329 affects version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-28T21:12:12.887949+00:00",
      "status_notes": "Vulnerability CVE-2022-42252 affects version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket.",
      "vulnerability": {
        "name": "CVE-2022-42252"
      },
      "action_statement": "Vulnerability CVE-2022-42252 affects version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2022-45143 does not affect version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket. Target Tomcat 8.5.100 is not affected by CVE-2022-45143. The vulnerability (unescaped JSON values in JsonErrorReportValve allowing output manipulation) was fixed by upstream Apache commit 0cab3a56bd (Mark Thomas, Nov 2022), which was already included in the Apache Tomcat 8.5.100 release (tagged Mar 2024). The fix adds JSONFilter.escape() calls to sanitize type, message, and description values before embedding them in JSON output. No TuxCare-specific backport was required for 8.5.100 as the fix came from upstream.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-45143"
      },
      "impact_statement": "Target Tomcat 8.5.100 is not affected by CVE-2022-45143. The vulnerability (unescaped JSON values in JsonErrorReportValve allowing output manipulation) was fixed by upstream Apache commit 0cab3a56bd (Mark Thomas, Nov 2022), which was already included in the Apache Tomcat 8.5.100 release (tagged Mar 2024). The fix adds JSONFilter.escape() calls to sanitize type, message, and description values before embedding them in JSON output. No TuxCare-specific backport was required for 8.5.100 as the fix came from upstream."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-28T21:11:34.688190+00:00",
      "status_notes": "Vulnerability CVE-2023-24998 affects version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket.",
      "vulnerability": {
        "name": "CVE-2023-24998"
      },
      "action_statement": "Vulnerability CVE-2023-24998 affects version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-30T00:47:50.558433+00:00",
      "status_notes": "Vulnerability CVE-2023-41080 does not affect version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket. not_affected \u2014 Apache Tomcat 8.5.100 is NOT vulnerable to CVE-2023-41080 (Open Redirect in FORM authentication). The upstream fix commit 4998ad745b67edeadefe541c94ed029b53933d3b by Mark Thomas is present in HEAD and was included in the upstream release 8.5.93 before TuxCare adoption. The defensive code that strips protocol-relative URL patterns (URLs with multiple leading slashes like //evil.com) is present a...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-41080"
      },
      "impact_statement": "not_affected \u2014 Apache Tomcat 8.5.100 is NOT vulnerable to CVE-2023-41080 (Open Redirect in FORM authentication). The upstream fix commit 4998ad745b67edeadefe541c94ed029b53933d3b by Mark Thomas is present in HEAD and was included in the upstream release 8.5.93 before TuxCare adoption. The defensive code that strips protocol-relative URL patterns (URLs with multiple leading slashes like //evil.com) is present a..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-28T18:21:18.934330+00:00",
      "status_notes": "Vulnerability CVE-2023-42795 does not affect version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket. not_affected \u2014 Target Apache Tomcat 8.5.100 is NOT AFFECTED by CVE-2023-42795. The vulnerability affects versions 8.5.0 through 8.5.93 due to incomplete object recycling when exceptions occur during cleanup, potentially causing information leakage between requests. The fix was committed upstream by Mark Thomas (markt@apache.org) on 2023-10-05 in commit 30f8063d7a and shipped in version 8.5.94. Since the targe...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-42795"
      },
      "impact_statement": "not_affected \u2014 Target Apache Tomcat 8.5.100 is NOT AFFECTED by CVE-2023-42795. The vulnerability affects versions 8.5.0 through 8.5.93 due to incomplete object recycling when exceptions occur during cleanup, potentially causing information leakage between requests. The fix was committed upstream by Mark Thomas (markt@apache.org) on 2023-10-05 in commit 30f8063d7a and shipped in version 8.5.94. Since the targe..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-28T18:12:53.572239+00:00",
      "status_notes": "Vulnerability CVE-2023-44487 affects version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket.",
      "vulnerability": {
        "name": "CVE-2023-44487"
      },
      "action_statement": "Vulnerability CVE-2023-44487 affects version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-28T19:05:19.418788+00:00",
      "status_notes": "Vulnerability CVE-2023-45648 does not affect version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket. not_affected \u2014 Target Apache Tomcat 8.5.100 is NOT vulnerable to CVE-2023-45648. The upstream fix for HTTP trailer header validation was already present in the Apache Tomcat 8.5.100 release that TuxCare onboarded. The fix adds validation to reject non-token characters in trailer header names and control characters (except HT) in trailer header values, preventing request smuggling attacks. Commit c83fe47725f7a...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-45648"
      },
      "impact_statement": "not_affected \u2014 Target Apache Tomcat 8.5.100 is NOT vulnerable to CVE-2023-45648. The upstream fix for HTTP trailer header validation was already present in the Apache Tomcat 8.5.100 release that TuxCare onboarded. The fix adds validation to reject non-token characters in trailer header names and control characters (except HT) in trailer header values, preventing request smuggling attacks. Commit c83fe47725f7a..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-28T18:14:49.853815+00:00",
      "status_notes": "Vulnerability CVE-2023-46589 affects version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket.",
      "vulnerability": {
        "name": "CVE-2023-46589"
      },
      "action_statement": "Vulnerability CVE-2023-46589 affects version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2024-21733 affects version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket.",
      "vulnerability": {
        "name": "CVE-2024-21733"
      },
      "action_statement": "Vulnerability CVE-2024-21733 affects version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-23672 does not affect version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket. not_affected \u2014 Target Apache Tomcat 8.5.100 is NOT vulnerable to CVE-2024-23672. The upstream Apache Tomcat fix for the WebSocket close timeout issue was included in version 8.5.99 (commit 3631adb134 by Mark Thomas), and the target is based on version 8.5.100 which contains this fix. The complete timeout enforcement mechanism is present and functional: sessionCloseTimeoutExpiry tracking, checkCloseTimeout() m...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-23672"
      },
      "impact_statement": "not_affected \u2014 Target Apache Tomcat 8.5.100 is NOT vulnerable to CVE-2024-23672. The upstream Apache Tomcat fix for the WebSocket close timeout issue was included in version 8.5.99 (commit 3631adb134 by Mark Thomas), and the target is based on version 8.5.100 which contains this fix. The complete timeout enforcement mechanism is present and functional: sessionCloseTimeoutExpiry tracking, checkCloseTimeout() m..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-24549 does not affect version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket. The target (Apache Tomcat 8.5.100-tuxcare.10) is not affected by CVE-2024-24549. The vulnerability was fixed by upstream Apache in commit 0cac540a88 (authored by markt@apache.org on Jan 25, 2024) and included in the Apache Tomcat 8.5.100 release (tagged March 19, 2024). TuxCare adopted version 8.5.100 which already contained the fix. The vulnerable pattern (delayed validation of HTTP/2 headers until all frames are processed) is absent from the target code. CVE affects versions \"8.5.0 through 8.5.98\" and recommends upgrading to 8.5.99+; target is 8.5.100.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-24549"
      },
      "impact_statement": "The target (Apache Tomcat 8.5.100-tuxcare.10) is not affected by CVE-2024-24549. The vulnerability was fixed by upstream Apache in commit 0cac540a88 (authored by markt@apache.org on Jan 25, 2024) and included in the Apache Tomcat 8.5.100 release (tagged March 19, 2024). TuxCare adopted version 8.5.100 which already contained the fix. The vulnerable pattern (delayed validation of HTTP/2 headers until all frames are processed) is absent from the target code. CVE affects versions \"8.5.0 through 8.5.98\" and recommends upgrading to 8.5.99+; target is 8.5.100."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-34750 is fixed in version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket.",
      "vulnerability": {
        "name": "CVE-2024-34750"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-38286 is fixed in version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket.",
      "vulnerability": {
        "name": "CVE-2024-38286"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-50379 is fixed in version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket.",
      "vulnerability": {
        "name": "CVE-2024-50379"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2024-56337 affects version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket.",
      "vulnerability": {
        "name": "CVE-2024-56337"
      },
      "action_statement": "Vulnerability CVE-2024-56337 affects version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-24813 is fixed in version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket.",
      "vulnerability": {
        "name": "CVE-2025-24813"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-31650 is fixed in version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket.",
      "vulnerability": {
        "name": "CVE-2025-31650"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-31651 is fixed in version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket.",
      "vulnerability": {
        "name": "CVE-2025-31651"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-46701 is fixed in version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket.",
      "vulnerability": {
        "name": "CVE-2025-46701"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-48988 is fixed in version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket.",
      "vulnerability": {
        "name": "CVE-2025-48988"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-48989 is fixed in version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket.",
      "vulnerability": {
        "name": "CVE-2025-48989"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-28T18:12:53.572239+00:00",
      "status_notes": "Vulnerability CVE-2025-49124 affects version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket.",
      "vulnerability": {
        "name": "CVE-2025-49124"
      },
      "action_statement": "Vulnerability CVE-2025-49124 affects version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-49125 is fixed in version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket.",
      "vulnerability": {
        "name": "CVE-2025-49125"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-52434 is fixed in version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket.",
      "vulnerability": {
        "name": "CVE-2025-52434"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-52520 is fixed in version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket.",
      "vulnerability": {
        "name": "CVE-2025-52520"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-53506 is fixed in version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket.",
      "vulnerability": {
        "name": "CVE-2025-53506"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-55668 is fixed in version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket.",
      "vulnerability": {
        "name": "CVE-2025-55668"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-55752 is fixed in version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket.",
      "vulnerability": {
        "name": "CVE-2025-55752"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-55754 is fixed in version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket.",
      "vulnerability": {
        "name": "CVE-2025-55754"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-61795 is fixed in version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket.",
      "vulnerability": {
        "name": "CVE-2025-61795"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-66614 affects version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket, and is fixed in 8.5.100-tuxcare.8.",
      "vulnerability": {
        "name": "CVE-2025-66614"
      },
      "action_statement": "Vulnerability CVE-2025-66614 affects version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket, and is fixed in 8.5.100-tuxcare.8."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-30T10:58:34.392596+00:00",
      "status_notes": "Vulnerability CVE-2026-24734 affects version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket.",
      "vulnerability": {
        "name": "CVE-2026-24734"
      },
      "action_statement": "Vulnerability CVE-2026-24734 affects version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-24880 affects version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket, and is fixed in 8.5.100-tuxcare.10.",
      "vulnerability": {
        "name": "CVE-2026-24880"
      },
      "action_statement": "Vulnerability CVE-2026-24880 affects version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket, and is fixed in 8.5.100-tuxcare.10."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-25854 affects version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket, and is fixed in 8.5.100-tuxcare.9.",
      "vulnerability": {
        "name": "CVE-2026-25854"
      },
      "action_statement": "Vulnerability CVE-2026-25854 affects version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket, and is fixed in 8.5.100-tuxcare.9."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-28T18:12:53.572239+00:00",
      "status_notes": "Vulnerability CVE-2026-34483 affects version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket.",
      "vulnerability": {
        "name": "CVE-2026-34483"
      },
      "action_statement": "Vulnerability CVE-2026-34483 affects version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-28T18:10:34.135169+00:00",
      "status_notes": "Vulnerability CVE-2026-34487 affects version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket.",
      "vulnerability": {
        "name": "CVE-2026-34487"
      },
      "action_statement": "Vulnerability CVE-2026-34487 affects version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41284 affects version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket.",
      "vulnerability": {
        "name": "CVE-2026-41284"
      },
      "action_statement": "Vulnerability CVE-2026-41284 affects version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41293 affects version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket.",
      "vulnerability": {
        "name": "CVE-2026-41293"
      },
      "action_statement": "Vulnerability CVE-2026-41293 affects version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42498 affects version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket.",
      "vulnerability": {
        "name": "CVE-2026-42498"
      },
      "action_statement": "Vulnerability CVE-2026-42498 affects version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-43512 affects version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket.",
      "vulnerability": {
        "name": "CVE-2026-43512"
      },
      "action_statement": "Vulnerability CVE-2026-43512 affects version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-43513 affects version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket.",
      "vulnerability": {
        "name": "CVE-2026-43513"
      },
      "action_statement": "Vulnerability CVE-2026-43513 affects version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-43514 affects version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket.",
      "vulnerability": {
        "name": "CVE-2026-43514"
      },
      "action_statement": "Vulnerability CVE-2026-43514 affects version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-43515 affects version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket.",
      "vulnerability": {
        "name": "CVE-2026-43515"
      },
      "action_statement": "Vulnerability CVE-2026-43515 affects version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-65182 affects version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket.",
      "vulnerability": {
        "name": "CVE-2026-65182"
      },
      "action_statement": "Vulnerability CVE-2026-65182 affects version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-65905 affects version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket.",
      "vulnerability": {
        "name": "CVE-2026-65905"
      },
      "action_statement": "Vulnerability CVE-2026-65905 affects version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.100-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-68525 affects version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket.",
      "vulnerability": {
        "name": "CVE-2026-68525"
      },
      "action_statement": "Vulnerability CVE-2026-68525 affects version 8.5.100-tuxcare.7 of org.apache.tomcat.embed:tomcat-embed-websocket."
    }
  ]
}