{ "@id": "urn:uuid:98c9e33e-fe12-4ddc-ac99-65579dfb5ffc", "role": "Document Creator", "author": "https://tuxcare.com", "version": 37, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-10-30T22:36:28.853898+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } } ], "timestamp": "2026-10-28T23:28:44.006786+00:00", "status_notes": "Vulnerability CVE-2017-12617 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha.", "vulnerability": { "name": "CVE-2017-12617" }, "action_statement": "Vulnerability CVE-2017-12617 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } } ], "timestamp": "2026-10-30T14:57:45.485772+00:00", "status_notes": "Vulnerability CVE-2017-5648 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha.", "vulnerability": { "name": "CVE-2017-5648" }, "action_statement": "Vulnerability CVE-2017-5648 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } } ], "timestamp": "2026-10-30T14:57:45.485772+00:00", "status_notes": "Vulnerability CVE-2019-0199 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha.", "vulnerability": { "name": "CVE-2019-0199" }, "action_statement": "Vulnerability CVE-2019-0199 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } } ], "timestamp": "2026-10-30T14:57:45.485772+00:00", "status_notes": "Vulnerability CVE-2019-0221 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha.", "vulnerability": { "name": "CVE-2019-0221" }, "action_statement": "Vulnerability CVE-2019-0221 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } } ], "timestamp": "2026-10-28T23:49:59.024011+00:00", "status_notes": "Vulnerability CVE-2020-13934 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha.", "vulnerability": { "name": "CVE-2020-13934" }, "action_statement": "Vulnerability CVE-2020-13934 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } } ], "timestamp": "2026-10-28T23:49:59.024011+00:00", "status_notes": "Vulnerability CVE-2020-13943 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha.", "vulnerability": { "name": "CVE-2020-13943" }, "action_statement": "Vulnerability CVE-2020-13943 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } } ], "timestamp": "2026-10-28T23:49:59.024011+00:00", "status_notes": "Vulnerability CVE-2020-17527 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha.", "vulnerability": { "name": "CVE-2020-17527" }, "action_statement": "Vulnerability CVE-2020-17527 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } } ], "timestamp": "2026-10-28T23:28:44.006786+00:00", "status_notes": "Vulnerability CVE-2020-9484 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha.", "vulnerability": { "name": "CVE-2020-9484" }, "action_statement": "Vulnerability CVE-2020-9484 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } } ], "timestamp": "2026-10-30T15:44:00.110412+00:00", "status_notes": "Vulnerability CVE-2021-25122 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha.", "vulnerability": { "name": "CVE-2021-25122" }, "action_statement": "Vulnerability CVE-2021-25122 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } } ], "timestamp": "2026-10-28T21:12:12.887949+00:00", "status_notes": "Vulnerability CVE-2022-42252 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha.", "vulnerability": { "name": "CVE-2022-42252" }, "action_statement": "Vulnerability CVE-2022-42252 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } } ], "timestamp": "2026-10-28T21:04:11.478044+00:00", "status_notes": "Vulnerability CVE-2022-45143 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha.", "vulnerability": { "name": "CVE-2022-45143" }, "action_statement": "Vulnerability CVE-2022-45143 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } } ], "timestamp": "2026-10-28T21:11:34.688190+00:00", "status_notes": "Vulnerability CVE-2023-24998 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha.", "vulnerability": { "name": "CVE-2023-24998" }, "action_statement": "Vulnerability CVE-2023-24998 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } } ], "timestamp": "2026-10-30T01:28:48.786102+00:00", "status_notes": "Vulnerability CVE-2023-28708 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha. not_affected \u2014 CVE-2023-28708 affects Apache Tomcat versions 10.1.0-M1 to 10.1.5, where RemoteIpFilter fails to propagate the secure flag when X-Forwarded-Proto is set to https, resulting in session cookies without the Secure attribute. The target version 10.1.16 is beyond the affected range and already contains the upstream fix. The fix (commit f509bbf31f by lihan@apache.org) was present in the upstream Apac...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-28708" }, "impact_statement": "not_affected \u2014 CVE-2023-28708 affects Apache Tomcat versions 10.1.0-M1 to 10.1.5, where RemoteIpFilter fails to propagate the secure flag when X-Forwarded-Proto is set to https, resulting in session cookies without the Secure attribute. The target version 10.1.16 is beyond the affected range and already contains the upstream fix. The fix (commit f509bbf31f by lihan@apache.org) was present in the upstream Apac..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } } ], "timestamp": "2026-10-30T00:52:00.186686+00:00", "status_notes": "Vulnerability CVE-2023-41080 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha. not_affected \u2014 CVE-2023-41080 (open redirect via protocol-relative URLs in FORM authentication) is NOT present in Apache Tomcat 10.1.16. The upstream fix (commit bb4624a9f3) was already included in the Tomcat 10.1.16 release before TuxCare onboarded it. The vulnerable pattern (missing sanitization of leading slashes in savedRequestURL) does not exist; the fix code at FormAuthenticator.java:765-768 strips lead...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-41080" }, "impact_statement": "not_affected \u2014 CVE-2023-41080 (open redirect via protocol-relative URLs in FORM authentication) is NOT present in Apache Tomcat 10.1.16. The upstream fix (commit bb4624a9f3) was already included in the Tomcat 10.1.16 release before TuxCare onboarded it. The vulnerable pattern (missing sanitization of leading slashes in savedRequestURL) does not exist; the fix code at FormAuthenticator.java:765-768 strips lead..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } } ], "timestamp": "2026-10-28T18:11:36.374923+00:00", "status_notes": "Vulnerability CVE-2023-42794 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha.", "vulnerability": { "name": "CVE-2023-42794" }, "action_statement": "Vulnerability CVE-2023-42794 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } } ], "timestamp": "2026-10-28T18:22:18.734162+00:00", "status_notes": "Vulnerability CVE-2023-42795 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha. not_affected \u2014 Apache Tomcat 10.1.16 is not affected by CVE-2023-42795. The vulnerability affects versions 10.1.0-M1 through 10.1.13, and was fixed in 10.1.14 and later. Since 10.1.16 > 10.1.14, the fix was already present in the upstream release when TuxCare onboarded it. All five recycle() method fixes (exception handling in Request.part.delete(), ApplicationHttpRequest.session.endAccess(), B2CConverter.dec...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-42795" }, "impact_statement": "not_affected \u2014 Apache Tomcat 10.1.16 is not affected by CVE-2023-42795. The vulnerability affects versions 10.1.0-M1 through 10.1.13, and was fixed in 10.1.14 and later. Since 10.1.16 > 10.1.14, the fix was already present in the upstream release when TuxCare onboarded it. All five recycle() method fixes (exception handling in Request.part.delete(), ApplicationHttpRequest.session.endAccess(), B2CConverter.dec..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } } ], "timestamp": "2026-10-28T18:12:53.572239+00:00", "status_notes": "Vulnerability CVE-2023-44487 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha.", "vulnerability": { "name": "CVE-2023-44487" }, "action_statement": "Vulnerability CVE-2023-44487 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2023-45648 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha. not_affected \u2014 The target Tomcat 10.1.16 is NOT AFFECTED by CVE-2023-45648. The vulnerability involves improper validation of HTTP trailer headers that could enable request smuggling. The upstream fix (commit 8ecff306507be8e4fd3adee1ae5de1ea6661a8f4 by Mark Thomas) was already present in the Tomcat 10.1.16 release that TuxCare onboarded. Both ChunkedInputFilter.java and Http11InputBuffer.java contain the requ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-45648" }, "impact_statement": "not_affected \u2014 The target Tomcat 10.1.16 is NOT AFFECTED by CVE-2023-45648. The vulnerability involves improper validation of HTTP trailer headers that could enable request smuggling. The upstream fix (commit 8ecff306507be8e4fd3adee1ae5de1ea6661a8f4 by Mark Thomas) was already present in the Tomcat 10.1.16 release that TuxCare onboarded. Both ChunkedInputFilter.java and Http11InputBuffer.java contain the requ..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability CVE-2023-46589 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha.", "vulnerability": { "name": "CVE-2023-46589" }, "action_statement": "Vulnerability CVE-2023-46589 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } } ], "timestamp": "2026-10-28T23:49:59.024011+00:00", "status_notes": "Vulnerability CVE-2024-21733 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha.", "vulnerability": { "name": "CVE-2024-21733" }, "action_statement": "Vulnerability CVE-2024-21733 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } } ], "timestamp": "2026-10-22T17:13:00.132903+00:00", "status_notes": "Vulnerability CVE-2024-24549 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha.", "vulnerability": { "name": "CVE-2024-24549" }, "action_statement": "Vulnerability CVE-2024-24549 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } } ], "timestamp": "2026-10-22T17:13:41.223423+00:00", "status_notes": "Vulnerability CVE-2024-34750 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha.", "vulnerability": { "name": "CVE-2024-34750" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } } ], "timestamp": "2026-10-22T17:13:41.223423+00:00", "status_notes": "Vulnerability CVE-2024-38286 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha.", "vulnerability": { "name": "CVE-2024-38286" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } } ], "timestamp": "2026-10-22T17:13:00.132903+00:00", "status_notes": "Vulnerability CVE-2024-50379 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha.", "vulnerability": { "name": "CVE-2024-50379" }, "action_statement": "Vulnerability CVE-2024-50379 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } } ], "timestamp": "2026-10-22T17:13:41.223423+00:00", "status_notes": "Vulnerability CVE-2024-52316 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha.", "vulnerability": { "name": "CVE-2024-52316" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } } ], "timestamp": "2026-10-22T17:13:00.132903+00:00", "status_notes": "Vulnerability CVE-2024-56337 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha.", "vulnerability": { "name": "CVE-2024-56337" }, "action_statement": "Vulnerability CVE-2024-56337 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } } ], "timestamp": "2026-10-22T17:13:00.132903+00:00", "status_notes": "Vulnerability CVE-2025-24813 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha.", "vulnerability": { "name": "CVE-2025-24813" }, "action_statement": "Vulnerability CVE-2025-24813 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } } ], "timestamp": "2026-10-22T17:13:00.132903+00:00", "status_notes": "Vulnerability CVE-2025-31650 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha.", "vulnerability": { "name": "CVE-2025-31650" }, "action_statement": "Vulnerability CVE-2025-31650 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } } ], "timestamp": "2026-10-22T17:13:00.132903+00:00", "status_notes": "Vulnerability CVE-2025-31651 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha.", "vulnerability": { "name": "CVE-2025-31651" }, "action_statement": "Vulnerability CVE-2025-31651 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } } ], "timestamp": "2026-10-22T17:13:00.132903+00:00", "status_notes": "Vulnerability CVE-2025-46701 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha.", "vulnerability": { "name": "CVE-2025-46701" }, "action_statement": "Vulnerability CVE-2025-46701 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } } ], "timestamp": "2026-10-22T17:13:00.132903+00:00", "status_notes": "Vulnerability CVE-2025-48988 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha.", "vulnerability": { "name": "CVE-2025-48988" }, "action_statement": "Vulnerability CVE-2025-48988 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } } ], "timestamp": "2026-10-22T17:13:41.223423+00:00", "status_notes": "Vulnerability CVE-2025-48989 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha.", "vulnerability": { "name": "CVE-2025-48989" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } } ], "timestamp": "2026-10-22T17:13:00.132903+00:00", "status_notes": "Vulnerability CVE-2025-49124 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha.", "vulnerability": { "name": "CVE-2025-49124" }, "action_statement": "Vulnerability CVE-2025-49124 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } } ], "timestamp": "2026-10-22T17:13:00.132903+00:00", "status_notes": "Vulnerability CVE-2025-49125 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha.", "vulnerability": { "name": "CVE-2025-49125" }, "action_statement": "Vulnerability CVE-2025-49125 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability CVE-2025-52434 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha.", "vulnerability": { "name": "CVE-2025-52434" }, "action_statement": "Vulnerability CVE-2025-52434 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } } ], "timestamp": "2026-10-22T17:13:41.223423+00:00", "status_notes": "Vulnerability CVE-2025-52520 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha.", "vulnerability": { "name": "CVE-2025-52520" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } } ], "timestamp": "2026-10-22T17:13:00.132903+00:00", "status_notes": "Vulnerability CVE-2025-53506 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha.", "vulnerability": { "name": "CVE-2025-53506" }, "action_statement": "Vulnerability CVE-2025-53506 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } } ], "timestamp": "2026-10-22T17:13:00.132903+00:00", "status_notes": "Vulnerability CVE-2025-55668 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha.", "vulnerability": { "name": "CVE-2025-55668" }, "action_statement": "Vulnerability CVE-2025-55668 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } } ], "timestamp": "2026-10-22T17:13:00.132903+00:00", "status_notes": "Vulnerability CVE-2025-55752 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha. Version 10.1.16 is NOT vulnerable to CVE-2025-55752. The vulnerable code pattern (normalizing before decoding in RewriteValve) was introduced later in version 10.1.40. Version 10.1.16 uses a different code structure that does not call URLDecoder.decode after RequestUtil.normalize, thus the vulnerability is not present. The CVE advisory's version range \"10.1.0-M1 through 10.1.44\" is over-broad; only versions 10.1.40-10.1.44 contain the vulnerable pattern.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-55752" }, "impact_statement": "Version 10.1.16 is NOT vulnerable to CVE-2025-55752. The vulnerable code pattern (normalizing before decoding in RewriteValve) was introduced later in version 10.1.40. Version 10.1.16 uses a different code structure that does not call URLDecoder.decode after RequestUtil.normalize, thus the vulnerability is not present. The CVE advisory's version range \"10.1.0-M1 through 10.1.44\" is over-broad; only versions 10.1.40-10.1.44 contain the vulnerable pattern." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } } ], "timestamp": "2026-10-22T17:13:00.132903+00:00", "status_notes": "Vulnerability CVE-2025-55754 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha.", "vulnerability": { "name": "CVE-2025-55754" }, "action_statement": "Vulnerability CVE-2025-55754 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } } ], "timestamp": "2026-10-22T17:13:00.132903+00:00", "status_notes": "Vulnerability CVE-2025-61795 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha.", "vulnerability": { "name": "CVE-2025-61795" }, "action_statement": "Vulnerability CVE-2025-61795 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } } ], "timestamp": "2026-10-22T17:13:41.223423+00:00", "status_notes": "Vulnerability CVE-2025-66614 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha.", "vulnerability": { "name": "CVE-2025-66614" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } } ], "timestamp": "2026-10-22T17:13:00.132903+00:00", "status_notes": "Vulnerability CVE-2026-24733 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha.", "vulnerability": { "name": "CVE-2026-24733" }, "action_statement": "Vulnerability CVE-2026-24733 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } } ], "timestamp": "2026-10-22T17:13:00.132903+00:00", "status_notes": "Vulnerability CVE-2026-24734 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha.", "vulnerability": { "name": "CVE-2026-24734" }, "action_statement": "Vulnerability CVE-2026-24734 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } } ], "timestamp": "2026-10-22T17:13:00.132903+00:00", "status_notes": "Vulnerability CVE-2026-24880 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha.", "vulnerability": { "name": "CVE-2026-24880" }, "action_statement": "Vulnerability CVE-2026-24880 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } } ], "timestamp": "2026-10-22T17:13:41.223423+00:00", "status_notes": "Vulnerability CVE-2026-25854 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha.", "vulnerability": { "name": "CVE-2026-25854" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } } ], "timestamp": "2026-10-22T17:13:41.223423+00:00", "status_notes": "Vulnerability CVE-2026-29146 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha.", "vulnerability": { "name": "CVE-2026-29146" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } } ], "timestamp": "2026-10-22T17:13:41.223423+00:00", "status_notes": "Vulnerability CVE-2026-34483 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha.", "vulnerability": { "name": "CVE-2026-34483" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } } ], "timestamp": "2026-10-30T22:36:28.853898+00:00", "status_notes": "Vulnerability CVE-2026-34486 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha.", "vulnerability": { "name": "CVE-2026-34486" }, "action_statement": "Vulnerability CVE-2026-34486 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } } ], "timestamp": "2026-10-22T17:13:00.132903+00:00", "status_notes": "Vulnerability CVE-2026-34487 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha.", "vulnerability": { "name": "CVE-2026-34487" }, "action_statement": "Vulnerability CVE-2026-34487 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } } ], "timestamp": "2026-10-22T17:13:41.223423+00:00", "status_notes": "Vulnerability CVE-2026-41284 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha.", "vulnerability": { "name": "CVE-2026-41284" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } } ], "timestamp": "2026-10-22T17:13:41.223423+00:00", "status_notes": "Vulnerability CVE-2026-41293 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha.", "vulnerability": { "name": "CVE-2026-41293" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } } ], "timestamp": "2026-10-22T17:13:41.223423+00:00", "status_notes": "Vulnerability CVE-2026-42498 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha.", "vulnerability": { "name": "CVE-2026-42498" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } } ], "timestamp": "2026-10-22T17:13:00.132903+00:00", "status_notes": "Vulnerability CVE-2026-43512 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha.", "vulnerability": { "name": "CVE-2026-43512" }, "action_statement": "Vulnerability CVE-2026-43512 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } } ], "timestamp": "2026-10-22T17:13:00.132903+00:00", "status_notes": "Vulnerability CVE-2026-43513 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha.", "vulnerability": { "name": "CVE-2026-43513" }, "action_statement": "Vulnerability CVE-2026-43513 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } } ], "timestamp": "2026-10-22T17:13:00.132903+00:00", "status_notes": "Vulnerability CVE-2026-43514 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha.", "vulnerability": { "name": "CVE-2026-43514" }, "action_statement": "Vulnerability CVE-2026-43514 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } } ], "timestamp": "2026-10-22T17:13:41.223423+00:00", "status_notes": "Vulnerability CVE-2026-43515 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha.", "vulnerability": { "name": "CVE-2026-43515" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } } ], "timestamp": "2026-10-23T21:50:56.656209+00:00", "status_notes": "Vulnerability CVE-2026-53434 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha.", "vulnerability": { "name": "CVE-2026-53434" }, "action_statement": "Vulnerability CVE-2026-53434 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } } ], "timestamp": "2026-10-22T17:13:00.132903+00:00", "status_notes": "Vulnerability CVE-2026-65182 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha.", "vulnerability": { "name": "CVE-2026-65182" }, "action_statement": "Vulnerability CVE-2026-65182 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } } ], "timestamp": "2026-10-22T17:13:00.132903+00:00", "status_notes": "Vulnerability CVE-2026-65905 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha.", "vulnerability": { "name": "CVE-2026-65905" }, "action_statement": "Vulnerability CVE-2026-65905 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } } ], "timestamp": "2026-10-22T17:13:41.223423+00:00", "status_notes": "Vulnerability CVE-2026-68525 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha.", "vulnerability": { "name": "CVE-2026-68525" } } ] }