{
  "@id": "urn:uuid:694c0999-5cd7-4305-9825-e7efcfbe49e8",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 24,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-30T15:44:00.110412+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T02:36:49.908127+00:00",
      "status_notes": "Vulnerability CVE-2016-8735 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote.",
      "vulnerability": {
        "name": "CVE-2016-8735"
      },
      "action_statement": "Vulnerability CVE-2016-8735 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T11:04:45.401942+00:00",
      "status_notes": "Vulnerability CVE-2017-12617 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote. Target is pristine upstream Apache Tomcat 8.5.46 (HEAD detached at tag 8.5.46, SHA 914f68b451). CVE-2017-12617 is a JSP-upload RCE: with the Default/WebDAV servlet's readonly init-param set to false, an attacker could PUT a JSP whose target path carries a trailing slash (e.g. `PUT /evil.jsp/`) so it bypasses the `*.jsp`\u2192JspServlet mapping and is written by the DefaultServlet as `evil.jsp` (the File API drops the trailing '/'); a later `GET /evil.jsp` executes it. The upstream remainder-of-fix (apache/tomcat commit 4cf7dab8, Mark Thomas, bug 61542) is present: DirResourceSet.write() rejects any path ending in '/' before creating the file (lines 220-224: `if (path.endsWith(\"/\")) return false;`). DirResourceSet is the sole writable resource set reachable from DefaultServlet.doPut \u2192 StandardRoot.write \u2192 main.write; FileResourceSet.write and EmptyResourceSet.write unconditionally return false. AbstractFileResourceSet.file() additionally enforces canonical-path/case-sensitivity and Windows-filename checks (lines 65, 83, 130). Fix commit (one of the supplied patch URLs) is an upstream, Apache-authored change baked into the 8.5.46 release \u2014 not vulnerable. Verdict: not_affected (upstream fix present; vulnerable pattern absent from HEAD).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-12617"
      },
      "impact_statement": "Target is pristine upstream Apache Tomcat 8.5.46 (HEAD detached at tag 8.5.46, SHA 914f68b451). CVE-2017-12617 is a JSP-upload RCE: with the Default/WebDAV servlet's readonly init-param set to false, an attacker could PUT a JSP whose target path carries a trailing slash (e.g. `PUT /evil.jsp/`) so it bypasses the `*.jsp`\u2192JspServlet mapping and is written by the DefaultServlet as `evil.jsp` (the File API drops the trailing '/'); a later `GET /evil.jsp` executes it. The upstream remainder-of-fix (apache/tomcat commit 4cf7dab8, Mark Thomas, bug 61542) is present: DirResourceSet.write() rejects any path ending in '/' before creating the file (lines 220-224: `if (path.endsWith(\"/\")) return false;`). DirResourceSet is the sole writable resource set reachable from DefaultServlet.doPut \u2192 StandardRoot.write \u2192 main.write; FileResourceSet.write and EmptyResourceSet.write unconditionally return false. AbstractFileResourceSet.file() additionally enforces canonical-path/case-sensitivity and Windows-filename checks (lines 65, 83, 130). Fix commit (one of the supplied patch URLs) is an upstream, Apache-authored change baked into the 8.5.46 release \u2014 not vulnerable. Verdict: not_affected (upstream fix present; vulnerable pattern absent from HEAD)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T14:57:45.485772+00:00",
      "status_notes": "Vulnerability CVE-2017-5648 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote. CVE-2017-5648: Tomcat fired request lifecycle events (requestInitialized/requestDestroyed) to application listeners using the raw internal org.apache.catalina.connector.Request object instead of its facade. Under a SecurityManager, an untrusted webapp's listener could retain that reference and reach another webapp's request/response data. Affected: 8.5.0\u20138.5.11; fixed in 8.5.12. Target is 8.5.46. The upstream tc8.5.x fix commit 0f7b9465 (\"Ensure request and response facades are used when firing application listeners\", Mark Thomas, svn r1785775) is an ancestor of HEAD, and all patched call sites now pass the facade: StandardHostValve.java:125/181, AsyncContextImpl.java:112, and FormAuthenticator.java:430/432/476/478 all use context.fireRequestInitEvent/DestroyEvent(request.getRequest()). The vulnerable pre-fix pattern (passing raw `request`) is absent from HEAD. The only remaining raw-`request` callers (ApplicationDispatcher.java:458/476) were intentionally left unchanged upstream because that `request` is the application-facing ServletRequest argument of the public RequestDispatcher.forward/include API \u2014 already a facade/wrapper, never the internal connector.Request. Fix is upstream-authored (apache.org), not a TuxCare backport, so verdict is not_affected / code_not_present rather than already_fixed.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-5648"
      },
      "impact_statement": "CVE-2017-5648: Tomcat fired request lifecycle events (requestInitialized/requestDestroyed) to application listeners using the raw internal org.apache.catalina.connector.Request object instead of its facade. Under a SecurityManager, an untrusted webapp's listener could retain that reference and reach another webapp's request/response data. Affected: 8.5.0\u20138.5.11; fixed in 8.5.12. Target is 8.5.46. The upstream tc8.5.x fix commit 0f7b9465 (\"Ensure request and response facades are used when firing application listeners\", Mark Thomas, svn r1785775) is an ancestor of HEAD, and all patched call sites now pass the facade: StandardHostValve.java:125/181, AsyncContextImpl.java:112, and FormAuthenticator.java:430/432/476/478 all use context.fireRequestInitEvent/DestroyEvent(request.getRequest()). The vulnerable pre-fix pattern (passing raw `request`) is absent from HEAD. The only remaining raw-`request` callers (ApplicationDispatcher.java:458/476) were intentionally left unchanged upstream because that `request` is the application-facing ServletRequest argument of the public RequestDispatcher.forward/include API \u2014 already a facade/wrapper, never the internal connector.Request. Fix is upstream-authored (apache.org), not a TuxCare backport, so verdict is not_affected / code_not_present rather than already_fixed."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T14:57:45.485772+00:00",
      "status_notes": "Vulnerability CVE-2019-0199 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote.",
      "vulnerability": {
        "name": "CVE-2019-0199"
      },
      "action_statement": "Vulnerability CVE-2019-0199 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T14:57:45.485772+00:00",
      "status_notes": "Vulnerability CVE-2019-0221 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote.",
      "vulnerability": {
        "name": "CVE-2019-0221"
      },
      "action_statement": "Vulnerability CVE-2019-0221 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T11:04:45.401942+00:00",
      "status_notes": "Vulnerability CVE-2019-2684 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote. not_affected \u2014 Tomcat 8.5.46 contains vulnerable JMX/RMI code that could expose CVE-2019-2684 (Java SE RMI deserialization), but this code is not reachable in the default shipped configuration. The vulnerable JmxRemoteLifecycleListener class exists in the codebase and uses the unpatched `LocateRegistry.createRegistry()` + `registry.bind()` pattern that allows unauthorized RMI registry modifications. However, ...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2019-2684"
      },
      "impact_statement": "not_affected \u2014 Tomcat 8.5.46 contains vulnerable JMX/RMI code that could expose CVE-2019-2684 (Java SE RMI deserialization), but this code is not reachable in the default shipped configuration. The vulnerable JmxRemoteLifecycleListener class exists in the codebase and uses the unpatched `LocateRegistry.createRegistry()` + `registry.bind()` pattern that allows unauthorized RMI registry modifications. However, ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T11:04:45.401942+00:00",
      "status_notes": "Vulnerability CVE-2020-13934 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote.",
      "vulnerability": {
        "name": "CVE-2020-13934"
      },
      "action_statement": "Vulnerability CVE-2020-13934 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T11:04:45.401942+00:00",
      "status_notes": "Vulnerability CVE-2020-13943 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote.",
      "vulnerability": {
        "name": "CVE-2020-13943"
      },
      "action_statement": "Vulnerability CVE-2020-13943 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T11:04:45.401942+00:00",
      "status_notes": "Vulnerability CVE-2020-17527 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote.",
      "vulnerability": {
        "name": "CVE-2020-17527"
      },
      "action_statement": "Vulnerability CVE-2020-17527 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T11:04:45.401942+00:00",
      "status_notes": "Vulnerability CVE-2020-9484 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote.",
      "vulnerability": {
        "name": "CVE-2020-9484"
      },
      "action_statement": "Vulnerability CVE-2020-9484 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T15:44:00.110412+00:00",
      "status_notes": "Vulnerability CVE-2021-25122 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote.",
      "vulnerability": {
        "name": "CVE-2021-25122"
      },
      "action_statement": "Vulnerability CVE-2021-25122 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T11:04:45.401942+00:00",
      "status_notes": "Vulnerability CVE-2022-42252 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote. Tomcat 8.5.46 is not affected by CVE-2022-42252. The vulnerability requires the presence of HttpParser.isControl() validation in header parsing that removes malformed headers without rejecting requests when rejectIllegalHeader=false. Version 8.5.46 lacks this intermediate validation entirely. Instead, a Content-Length header whose value contains a control character other than CR or LF (e.g., Content-Length: 12\\u000734) is kept by header parsing, then rejected by Ascii.parseLong() which throws NumberFormatException, triggering an HTTP 400 response. An invalid Content-Length header is therefore never discarded while the request continues to be processed, which is the condition this vulnerability depends on.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-42252"
      },
      "impact_statement": "Tomcat 8.5.46 is not affected by CVE-2022-42252. The vulnerability requires the presence of HttpParser.isControl() validation in header parsing that removes malformed headers without rejecting requests when rejectIllegalHeader=false. Version 8.5.46 lacks this intermediate validation entirely. Instead, a Content-Length header whose value contains a control character other than CR or LF (e.g., Content-Length: 12\\u000734) is kept by header parsing, then rejected by Ascii.parseLong() which throws NumberFormatException, triggering an HTTP 400 response. An invalid Content-Length header is therefore never discarded while the request continues to be processed, which is the condition this vulnerability depends on."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T11:04:45.401942+00:00",
      "status_notes": "Vulnerability CVE-2022-45143 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote. Tomcat 8.5.46 is not affected by CVE-2022-45143. The vulnerable component JsonErrorReportValve does not exist in this version - it was introduced later in version 8.5.83. Version 8.5.46 only has ErrorReportValve which produces HTML error pages, not JSON. The CVE correctly identifies 8.5.83 as the first affected version in the 8.5.x series. No JSON error reporting capability exists in 8.5.46, therefore the vulnerability pattern (unescaped user-controlled values in JSON output) cannot occur.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-45143"
      },
      "impact_statement": "Tomcat 8.5.46 is not affected by CVE-2022-45143. The vulnerable component JsonErrorReportValve does not exist in this version - it was introduced later in version 8.5.83. Version 8.5.46 only has ErrorReportValve which produces HTML error pages, not JSON. The CVE correctly identifies 8.5.83 as the first affected version in the 8.5.x series. No JSON error reporting capability exists in 8.5.46, therefore the vulnerability pattern (unescaped user-controlled values in JSON output) cannot occur."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T21:11:34.688190+00:00",
      "status_notes": "Vulnerability CVE-2023-24998 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote.",
      "vulnerability": {
        "name": "CVE-2023-24998"
      },
      "action_statement": "Vulnerability CVE-2023-24998 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T11:06:38.524754+00:00",
      "status_notes": "Vulnerability CVE-2023-28708 is fixed in version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote.",
      "vulnerability": {
        "name": "CVE-2023-28708"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T11:06:38.524754+00:00",
      "status_notes": "Vulnerability CVE-2023-41080 is fixed in version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote.",
      "vulnerability": {
        "name": "CVE-2023-41080"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T18:45:57.071664+00:00",
      "status_notes": "Vulnerability CVE-2023-42794 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote. not_affected \u2014 Target version 8.5.46 is NOT affected by CVE-2023-42794. The vulnerability only affected versions 8.5.85-8.5.93, where a refactoring removed the finalize() method from DiskFileItem. Version 8.5.46 predates this refactoring and retains the original finalize() method that automatically deletes temporary files during garbage collection, preventing the disk exhaustion issue. The fix was already pre...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-42794"
      },
      "impact_statement": "not_affected \u2014 Target version 8.5.46 is NOT affected by CVE-2023-42794. The vulnerability only affected versions 8.5.85-8.5.93, where a refactoring removed the finalize() method from DiskFileItem. Version 8.5.46 predates this refactoring and retains the original finalize() method that automatically deletes temporary files during garbage collection, preventing the disk exhaustion issue. The fix was already pre..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T11:04:45.401942+00:00",
      "status_notes": "Vulnerability CVE-2023-42795 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote.",
      "vulnerability": {
        "name": "CVE-2023-42795"
      },
      "action_statement": "Vulnerability CVE-2023-42795 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T11:04:45.401942+00:00",
      "status_notes": "Vulnerability CVE-2023-44487 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote.",
      "vulnerability": {
        "name": "CVE-2023-44487"
      },
      "action_statement": "Vulnerability CVE-2023-44487 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T11:04:45.401942+00:00",
      "status_notes": "Vulnerability CVE-2023-45648 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote.",
      "vulnerability": {
        "name": "CVE-2023-45648"
      },
      "action_statement": "Vulnerability CVE-2023-45648 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T11:06:38.524754+00:00",
      "status_notes": "Vulnerability CVE-2023-46589 is fixed in version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote.",
      "vulnerability": {
        "name": "CVE-2023-46589"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T11:04:45.401942+00:00",
      "status_notes": "Vulnerability CVE-2024-21733 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote.",
      "vulnerability": {
        "name": "CVE-2024-21733"
      },
      "action_statement": "Vulnerability CVE-2024-21733 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T11:04:45.401942+00:00",
      "status_notes": "Vulnerability CVE-2024-24549 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote.",
      "vulnerability": {
        "name": "CVE-2024-24549"
      },
      "action_statement": "Vulnerability CVE-2024-24549 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T11:04:45.401942+00:00",
      "status_notes": "Vulnerability CVE-2024-34750 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote.",
      "vulnerability": {
        "name": "CVE-2024-34750"
      },
      "action_statement": "Vulnerability CVE-2024-34750 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T11:06:38.524754+00:00",
      "status_notes": "Vulnerability CVE-2024-38286 is fixed in version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote.",
      "vulnerability": {
        "name": "CVE-2024-38286"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T11:04:45.401942+00:00",
      "status_notes": "Vulnerability CVE-2024-50379 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote.",
      "vulnerability": {
        "name": "CVE-2024-50379"
      },
      "action_statement": "Vulnerability CVE-2024-50379 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T11:04:45.401942+00:00",
      "status_notes": "Vulnerability CVE-2024-52316 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote.",
      "vulnerability": {
        "name": "CVE-2024-52316"
      },
      "action_statement": "Vulnerability CVE-2024-52316 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2024-56337 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote.",
      "vulnerability": {
        "name": "CVE-2024-56337"
      },
      "action_statement": "Vulnerability CVE-2024-56337 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T11:06:38.524754+00:00",
      "status_notes": "Vulnerability CVE-2025-24813 is fixed in version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote.",
      "vulnerability": {
        "name": "CVE-2025-24813"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T11:04:45.401942+00:00",
      "status_notes": "Vulnerability CVE-2025-31650 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote. Target version 8.5.46 is NOT affected by CVE-2025-31650. The vulnerability requires RFC 9218 (HTTP/2 Extensible Priorities) support, which was not implemented until Tomcat 8.5.90. Version 8.5.46 only supports RFC 7540's binary PRIORITY frames and lacks the vulnerable text-based priority field parsing code entirely. The CVE explicitly states affected versions start from 8.5.90, and target 8.5.46 predates this by 44 minor versions.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-31650"
      },
      "impact_statement": "Target version 8.5.46 is NOT affected by CVE-2025-31650. The vulnerability requires RFC 9218 (HTTP/2 Extensible Priorities) support, which was not implemented until Tomcat 8.5.90. Version 8.5.46 only supports RFC 7540's binary PRIORITY frames and lacks the vulnerable text-based priority field parsing code entirely. The CVE explicitly states affected versions start from 8.5.90, and target 8.5.46 predates this by 44 minor versions."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T11:04:45.401942+00:00",
      "status_notes": "Vulnerability CVE-2025-31651 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote.",
      "vulnerability": {
        "name": "CVE-2025-31651"
      },
      "action_statement": "Vulnerability CVE-2025-31651 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T11:06:38.524754+00:00",
      "status_notes": "Vulnerability CVE-2025-46701 is fixed in version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote.",
      "vulnerability": {
        "name": "CVE-2025-46701"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T11:06:38.524754+00:00",
      "status_notes": "Vulnerability CVE-2025-48988 is fixed in version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote.",
      "vulnerability": {
        "name": "CVE-2025-48988"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T18:11:36.374923+00:00",
      "status_notes": "Vulnerability CVE-2025-48989 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote.",
      "vulnerability": {
        "name": "CVE-2025-48989"
      },
      "action_statement": "Vulnerability CVE-2025-48989 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T18:12:53.572239+00:00",
      "status_notes": "Vulnerability CVE-2025-49124 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote.",
      "vulnerability": {
        "name": "CVE-2025-49124"
      },
      "action_statement": "Vulnerability CVE-2025-49124 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T11:06:38.524754+00:00",
      "status_notes": "Vulnerability CVE-2025-49125 is fixed in version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote.",
      "vulnerability": {
        "name": "CVE-2025-49125"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T11:06:38.524754+00:00",
      "status_notes": "Vulnerability CVE-2025-52434 is fixed in version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote.",
      "vulnerability": {
        "name": "CVE-2025-52434"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T11:04:45.401942+00:00",
      "status_notes": "Vulnerability CVE-2025-52520 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote.",
      "vulnerability": {
        "name": "CVE-2025-52520"
      },
      "action_statement": "Vulnerability CVE-2025-52520 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T11:06:38.524754+00:00",
      "status_notes": "Vulnerability CVE-2025-53506 is fixed in version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote.",
      "vulnerability": {
        "name": "CVE-2025-53506"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T18:14:49.853815+00:00",
      "status_notes": "Vulnerability CVE-2025-55668 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote.",
      "vulnerability": {
        "name": "CVE-2025-55668"
      },
      "action_statement": "Vulnerability CVE-2025-55668 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T11:06:38.524754+00:00",
      "status_notes": "Vulnerability CVE-2025-55752 is fixed in version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote.",
      "vulnerability": {
        "name": "CVE-2025-55752"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T18:11:01.360398+00:00",
      "status_notes": "Vulnerability CVE-2025-55754 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote.",
      "vulnerability": {
        "name": "CVE-2025-55754"
      },
      "action_statement": "Vulnerability CVE-2025-55754 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T11:06:38.524754+00:00",
      "status_notes": "Vulnerability CVE-2025-61795 is fixed in version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote.",
      "vulnerability": {
        "name": "CVE-2025-61795"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T11:06:38.524754+00:00",
      "status_notes": "Vulnerability CVE-2025-66614 is fixed in version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote.",
      "vulnerability": {
        "name": "CVE-2025-66614"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T11:06:38.524754+00:00",
      "status_notes": "Vulnerability CVE-2026-24733 is fixed in version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote.",
      "vulnerability": {
        "name": "CVE-2026-24733"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T21:58:36.804623+00:00",
      "status_notes": "Vulnerability CVE-2026-24734 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote.",
      "vulnerability": {
        "name": "CVE-2026-24734"
      },
      "action_statement": "Vulnerability CVE-2026-24734 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T11:06:38.524754+00:00",
      "status_notes": "Vulnerability CVE-2026-24880 is fixed in version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote.",
      "vulnerability": {
        "name": "CVE-2026-24880"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T11:06:38.524754+00:00",
      "status_notes": "Vulnerability CVE-2026-25854 is fixed in version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote.",
      "vulnerability": {
        "name": "CVE-2026-25854"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T18:12:53.572239+00:00",
      "status_notes": "Vulnerability CVE-2026-34483 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote.",
      "vulnerability": {
        "name": "CVE-2026-34483"
      },
      "action_statement": "Vulnerability CVE-2026-34483 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T11:04:45.401942+00:00",
      "status_notes": "Vulnerability CVE-2026-41284 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote.",
      "vulnerability": {
        "name": "CVE-2026-41284"
      },
      "action_statement": "Vulnerability CVE-2026-41284 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T11:04:45.401942+00:00",
      "status_notes": "Vulnerability CVE-2026-41293 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote.",
      "vulnerability": {
        "name": "CVE-2026-41293"
      },
      "action_statement": "Vulnerability CVE-2026-41293 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T11:04:45.401942+00:00",
      "status_notes": "Vulnerability CVE-2026-42498 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote.",
      "vulnerability": {
        "name": "CVE-2026-42498"
      },
      "action_statement": "Vulnerability CVE-2026-42498 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T11:04:45.401942+00:00",
      "status_notes": "Vulnerability CVE-2026-43512 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote.",
      "vulnerability": {
        "name": "CVE-2026-43512"
      },
      "action_statement": "Vulnerability CVE-2026-43512 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T11:04:45.401942+00:00",
      "status_notes": "Vulnerability CVE-2026-43513 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote.",
      "vulnerability": {
        "name": "CVE-2026-43513"
      },
      "action_statement": "Vulnerability CVE-2026-43513 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T11:04:45.401942+00:00",
      "status_notes": "Vulnerability CVE-2026-43514 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote.",
      "vulnerability": {
        "name": "CVE-2026-43514"
      },
      "action_statement": "Vulnerability CVE-2026-43514 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T11:04:45.401942+00:00",
      "status_notes": "Vulnerability CVE-2026-43515 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote.",
      "vulnerability": {
        "name": "CVE-2026-43515"
      },
      "action_statement": "Vulnerability CVE-2026-43515 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T21:58:36.804623+00:00",
      "status_notes": "Vulnerability CVE-2026-53434 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote.",
      "vulnerability": {
        "name": "CVE-2026-53434"
      },
      "action_statement": "Vulnerability CVE-2026-53434 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T11:04:45.401942+00:00",
      "status_notes": "Vulnerability CVE-2026-65182 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote.",
      "vulnerability": {
        "name": "CVE-2026-65182"
      },
      "action_statement": "Vulnerability CVE-2026-65182 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T11:04:45.401942+00:00",
      "status_notes": "Vulnerability CVE-2026-65905 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote.",
      "vulnerability": {
        "name": "CVE-2026-65905"
      },
      "action_statement": "Vulnerability CVE-2026-65905 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-jmx-remote@8.5.46-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T11:04:45.401942+00:00",
      "status_notes": "Vulnerability CVE-2026-68525 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote.",
      "vulnerability": {
        "name": "CVE-2026-68525"
      },
      "action_statement": "Vulnerability CVE-2026-68525 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-catalina-jmx-remote."
    }
  ]
}