{
  "@id": "urn:uuid:6277b6d0-a688-4077-9511-7f17b56f030d",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 31,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-30T15:44:00.110412+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T04:08:51.772780+00:00",
      "status_notes": "Vulnerability CVE-2016-5388 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina.",
      "vulnerability": {
        "name": "CVE-2016-5388"
      },
      "action_statement": "Vulnerability CVE-2016-5388 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T04:08:51.772780+00:00",
      "status_notes": "Vulnerability CVE-2016-8735 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina.",
      "vulnerability": {
        "name": "CVE-2016-8735"
      },
      "action_statement": "Vulnerability CVE-2016-8735 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T04:08:51.772780+00:00",
      "status_notes": "Vulnerability CVE-2017-12616 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina.",
      "vulnerability": {
        "name": "CVE-2017-12616"
      },
      "action_statement": "Vulnerability CVE-2017-12616 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T23:33:09.807961+00:00",
      "status_notes": "Vulnerability CVE-2017-12617 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina.",
      "vulnerability": {
        "name": "CVE-2017-12617"
      },
      "action_statement": "Vulnerability CVE-2017-12617 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T23:28:44.006786+00:00",
      "status_notes": "Vulnerability CVE-2017-5648 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina.",
      "vulnerability": {
        "name": "CVE-2017-5648"
      },
      "action_statement": "Vulnerability CVE-2017-5648 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T15:44:00.110412+00:00",
      "status_notes": "Vulnerability CVE-2019-0199 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina.",
      "vulnerability": {
        "name": "CVE-2019-0199"
      },
      "action_statement": "Vulnerability CVE-2019-0199 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T23:37:14.382670+00:00",
      "status_notes": "Vulnerability CVE-2019-0221 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina.",
      "vulnerability": {
        "name": "CVE-2019-0221"
      },
      "action_statement": "Vulnerability CVE-2019-0221 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2020-13934 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina. CVE-2020-13934 affects Apache Tomcat 9.0.0.M5-9.0.36",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-13934"
      },
      "impact_statement": "CVE-2020-13934 affects Apache Tomcat 9.0.0.M5-9.0.36"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2020-13943 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina. Version 9.0.87 is not vulnerable. Summary: CVE-2020-13943 does NOT affect the target repository (Apache Tomcat 9.0.87). The vulnerability was fixed in version 9.0.38, and the target contains the complete fix. The vulnerable code pattern (concurrent stream check in headersStart) does not exist in the target.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-13943"
      },
      "impact_statement": "Version 9.0.87 is not vulnerable. Summary: CVE-2020-13943 does NOT affect the target repository (Apache Tomcat 9.0.87). The vulnerability was fixed in version 9.0.38, and the target contains the complete fix. The vulnerable code pattern (concurrent stream check in headersStart) does not exist in the target."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2020-17527 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina.",
      "vulnerability": {
        "name": "CVE-2020-17527"
      },
      "action_statement": "Vulnerability CVE-2020-17527 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2020-9484 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina. Fix already present in baseline since 9.0.35. Verified in java/org/apache/catalina/session/FileStore.java:303 \u2014 canonicalFile.toPath().startsWith(storageDir.getCanonicalFile().toPath()) containment check is in place. Advisory range 9.0.0.M1-9.0.34; 9.0.90 is well past the fix.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-9484"
      },
      "impact_statement": "Fix already present in baseline since 9.0.35. Verified in java/org/apache/catalina/session/FileStore.java:303 \u2014 canonicalFile.toPath().startsWith(storageDir.getCanonicalFile().toPath()) containment check is in place. Advisory range 9.0.0.M1-9.0.34; 9.0.90 is well past the fix."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T15:44:00.110412+00:00",
      "status_notes": "Vulnerability CVE-2021-25122 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina.",
      "vulnerability": {
        "name": "CVE-2021-25122"
      },
      "action_statement": "Vulnerability CVE-2021-25122 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T21:12:12.887949+00:00",
      "status_notes": "Vulnerability CVE-2022-42252 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina.",
      "vulnerability": {
        "name": "CVE-2022-42252"
      },
      "action_statement": "Vulnerability CVE-2022-42252 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2022-45143 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina. CVE-2022-45143 is not a vulnerability in target Tomcat 9.0.87. The upstream Apache vendor fix (commit b336f4e58893ea35114f1e4a415657f723b1298e by Mark Thomas) that adds JSON escaping via JSONFilter.escape() to prevent JSON injection is already present in the target's base 9.0.87 release. All three error report fields (type, message, description) in JsonErrorReportValve are properly escaped before JSON output construction.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-45143"
      },
      "impact_statement": "CVE-2022-45143 is not a vulnerability in target Tomcat 9.0.87. The upstream Apache vendor fix (commit b336f4e58893ea35114f1e4a415657f723b1298e by Mark Thomas) that adds JSON escaping via JSONFilter.escape() to prevent JSON injection is already present in the target's base 9.0.87 release. All three error report fields (type, message, description) in JsonErrorReportValve are properly escaped before JSON output construction."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T21:11:34.688190+00:00",
      "status_notes": "Vulnerability CVE-2023-24998 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina.",
      "vulnerability": {
        "name": "CVE-2023-24998"
      },
      "action_statement": "Vulnerability CVE-2023-24998 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T01:23:31.601237+00:00",
      "status_notes": "Vulnerability CVE-2023-28708 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina. not_affected \u2014 CVE-2023-28708 affects Apache Tomcat 9.0.0-M1 to 9.0.71. The target is version 9.0.87, which already includes the upstream fix (commit 3b51230764 by lihan@apache.org, Feb 10 2023). The fix was shipped in the upstream Apache Tomcat 9.0.87 release that TuxCare onboarded (first TuxCare commit cfbc8da6fa is descendant of the fix). The vulnerable pattern\u2014XForwardedRequest having an isSecure() overri...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-28708"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-28708 affects Apache Tomcat 9.0.0-M1 to 9.0.71. The target is version 9.0.87, which already includes the upstream fix (commit 3b51230764 by lihan@apache.org, Feb 10 2023). The fix was shipped in the upstream Apache Tomcat 9.0.87 release that TuxCare onboarded (first TuxCare commit cfbc8da6fa is descendant of the fix). The vulnerable pattern\u2014XForwardedRequest having an isSecure() overri..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T00:49:00.093458+00:00",
      "status_notes": "Vulnerability CVE-2023-41080 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina. not_affected \u2014 CVE-2023-41080 does not affect Apache Tomcat 9.0.87. The open redirect vulnerability via protocol-relative URLs in FORM authentication was fixed by Apache upstream in versions after 9.0.79. The target version (9.0.87) includes the upstream fix from commit 77c0ce2d169e by Mark Thomas, which was present in the Apache 9.0.87 release before TuxCare onboarded it. The defense (stripping leading slash...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-41080"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-41080 does not affect Apache Tomcat 9.0.87. The open redirect vulnerability via protocol-relative URLs in FORM authentication was fixed by Apache upstream in versions after 9.0.79. The target version (9.0.87) includes the upstream fix from commit 77c0ce2d169e by Mark Thomas, which was present in the Apache 9.0.87 release before TuxCare onboarded it. The defense (stripping leading slash..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T18:40:55.741562+00:00",
      "status_notes": "Vulnerability CVE-2023-42794 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina. not_affected \u2014 Target version 9.0.87 is not affected by CVE-2023-42794. The vulnerability concerns missing cleanup of temporary uploaded files when application code fails to close streams, potentially leading to disk space exhaustion. The fix (adding a finalize() method to delete temporary files during garbage collection) was included in upstream Apache Tomcat 9.0.81+ and is present in the target's 9.0.87 rel...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-42794"
      },
      "impact_statement": "not_affected \u2014 Target version 9.0.87 is not affected by CVE-2023-42794. The vulnerability concerns missing cleanup of temporary uploaded files when application code fails to close streams, potentially leading to disk space exhaustion. The fix (adding a finalize() method to delete temporary files during garbage collection) was included in upstream Apache Tomcat 9.0.81+ and is present in the target's 9.0.87 rel..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T18:21:18.934330+00:00",
      "status_notes": "Vulnerability CVE-2023-42795 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina. not_affected \u2014 CVE-2023-42795 is not present in Tomcat 9.0.87. The vulnerability was fixed in upstream Apache Tomcat 9.0.81 (released October 2023), and version 9.0.87 already contains the complete fix. All four protection mechanisms from the upstream patch are present: (1) Request.recycle() wraps part.delete() in try-catch and correctly orders asyncContext nullification, (2) ApplicationHttpRequest.recycle() ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-42795"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-42795 is not present in Tomcat 9.0.87. The vulnerability was fixed in upstream Apache Tomcat 9.0.81 (released October 2023), and version 9.0.87 already contains the complete fix. All four protection mechanisms from the upstream patch are present: (1) Request.recycle() wraps part.delete() in try-catch and correctly orders asyncContext nullification, (2) ApplicationHttpRequest.recycle() ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T18:12:53.572239+00:00",
      "status_notes": "Vulnerability CVE-2023-44487 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina.",
      "vulnerability": {
        "name": "CVE-2023-44487"
      },
      "action_statement": "Vulnerability CVE-2023-44487 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T19:06:21.253116+00:00",
      "status_notes": "Vulnerability CVE-2023-45648 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina. not_affected \u2014 CVE-2023-45648 is NOT affecting this target. The vulnerability (improper HTTP trailer header parsing leading to request smuggling) was fixed by upstream Apache Tomcat in commit 59583245639 (Mark Thomas, 2023-10-05). This fix was already included in upstream Apache Tomcat 9.0.82+ and was present when TuxCare onboarded version 9.0.87. The target code contains both required validations: (1) traile...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-45648"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-45648 is NOT affecting this target. The vulnerability (improper HTTP trailer header parsing leading to request smuggling) was fixed by upstream Apache Tomcat in commit 59583245639 (Mark Thomas, 2023-10-05). This fix was already included in upstream Apache Tomcat 9.0.82+ and was present when TuxCare onboarded version 9.0.87. The target code contains both required validations: (1) traile..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T18:14:49.853815+00:00",
      "status_notes": "Vulnerability CVE-2023-46589 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina.",
      "vulnerability": {
        "name": "CVE-2023-46589"
      },
      "action_statement": "Vulnerability CVE-2023-46589 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2024-21733 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina.",
      "vulnerability": {
        "name": "CVE-2024-21733"
      },
      "action_statement": "Vulnerability CVE-2024-21733 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-24549 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina. CVE-2024-24549 is not present in Tomcat 9.0.87-tuxcare.6. The vulnerability (DoS via delayed HTTP/2 header validation) was fixed by upstream Apache in version 9.0.86 (commit 8e03be9f2698f2da9027d40b9e9c0c9429b74dc0 by Mark Thomas). TuxCare's 9.0.87-tuxcare.6 inherited this fix from upstream 9.0.87, which already contained the vendor fix. No TuxCare backport was required.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-24549"
      },
      "impact_statement": "CVE-2024-24549 is not present in Tomcat 9.0.87-tuxcare.6. The vulnerability (DoS via delayed HTTP/2 header validation) was fixed by upstream Apache in version 9.0.86 (commit 8e03be9f2698f2da9027d40b9e9c0c9429b74dc0 by Mark Thomas). TuxCare's 9.0.87-tuxcare.6 inherited this fix from upstream 9.0.87, which already contained the vendor fix. No TuxCare backport was required."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-34750 is fixed in version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina.",
      "vulnerability": {
        "name": "CVE-2024-34750"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-38286 is fixed in version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina.",
      "vulnerability": {
        "name": "CVE-2024-38286"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-50379 is fixed in version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina.",
      "vulnerability": {
        "name": "CVE-2024-50379"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-52316 is fixed in version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina.",
      "vulnerability": {
        "name": "CVE-2024-52316"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-56337 is fixed in version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina.",
      "vulnerability": {
        "name": "CVE-2024-56337"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-24813 is fixed in version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina.",
      "vulnerability": {
        "name": "CVE-2025-24813"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-31650 is fixed in version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina.",
      "vulnerability": {
        "name": "CVE-2025-31650"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-31651 is fixed in version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina.",
      "vulnerability": {
        "name": "CVE-2025-31651"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-46701 is fixed in version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina.",
      "vulnerability": {
        "name": "CVE-2025-46701"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-48988 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina, and is fixed in 9.0.87-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2025-48988"
      },
      "action_statement": "Vulnerability CVE-2025-48988 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina, and is fixed in 9.0.87-tuxcare.5."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-48989 is fixed in version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina.",
      "vulnerability": {
        "name": "CVE-2025-48989"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-49124 is fixed in version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina.",
      "vulnerability": {
        "name": "CVE-2025-49124"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-49125 is fixed in version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina.",
      "vulnerability": {
        "name": "CVE-2025-49125"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-52434 is fixed in version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina.",
      "vulnerability": {
        "name": "CVE-2025-52434"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-52520 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina.",
      "vulnerability": {
        "name": "CVE-2025-52520"
      },
      "action_statement": "Vulnerability CVE-2025-52520 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-53506 is fixed in version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina.",
      "vulnerability": {
        "name": "CVE-2025-53506"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-55668 is fixed in version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina.",
      "vulnerability": {
        "name": "CVE-2025-55668"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-55752 is fixed in version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina.",
      "vulnerability": {
        "name": "CVE-2025-55752"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-55754 is fixed in version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina.",
      "vulnerability": {
        "name": "CVE-2025-55754"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-61795 is fixed in version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina.",
      "vulnerability": {
        "name": "CVE-2025-61795"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-66614 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina.",
      "vulnerability": {
        "name": "CVE-2025-66614"
      },
      "action_statement": "Vulnerability CVE-2025-66614 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-24733 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina, and is fixed in 9.0.87-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-24733"
      },
      "action_statement": "Vulnerability CVE-2026-24733 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina, and is fixed in 9.0.87-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-24734 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina.",
      "vulnerability": {
        "name": "CVE-2026-24734"
      },
      "action_statement": "Vulnerability CVE-2026-24734 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-24880 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina.",
      "vulnerability": {
        "name": "CVE-2026-24880"
      },
      "action_statement": "Vulnerability CVE-2026-24880 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-25854 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina, and is fixed in 9.0.87-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2026-25854"
      },
      "action_statement": "Vulnerability CVE-2026-25854 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina, and is fixed in 9.0.87-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-34483 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina, and is fixed in 9.0.87-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2026-34483"
      },
      "action_statement": "Vulnerability CVE-2026-34483 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina, and is fixed in 9.0.87-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41284 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina.",
      "vulnerability": {
        "name": "CVE-2026-41284"
      },
      "action_statement": "Vulnerability CVE-2026-41284 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41293 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina.",
      "vulnerability": {
        "name": "CVE-2026-41293"
      },
      "action_statement": "Vulnerability CVE-2026-41293 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42498 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina.",
      "vulnerability": {
        "name": "CVE-2026-42498"
      },
      "action_statement": "Vulnerability CVE-2026-42498 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-43512 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina.",
      "vulnerability": {
        "name": "CVE-2026-43512"
      },
      "action_statement": "Vulnerability CVE-2026-43512 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-43513 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina.",
      "vulnerability": {
        "name": "CVE-2026-43513"
      },
      "action_statement": "Vulnerability CVE-2026-43513 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-43514 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina.",
      "vulnerability": {
        "name": "CVE-2026-43514"
      },
      "action_statement": "Vulnerability CVE-2026-43514 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-43515 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina.",
      "vulnerability": {
        "name": "CVE-2026-43515"
      },
      "action_statement": "Vulnerability CVE-2026-43515 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-23T21:50:56.656209+00:00",
      "status_notes": "Vulnerability CVE-2026-53434 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina.",
      "vulnerability": {
        "name": "CVE-2026-53434"
      },
      "action_statement": "Vulnerability CVE-2026-53434 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-65182 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina.",
      "vulnerability": {
        "name": "CVE-2026-65182"
      },
      "action_statement": "Vulnerability CVE-2026-65182 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-65905 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina.",
      "vulnerability": {
        "name": "CVE-2026-65905"
      },
      "action_statement": "Vulnerability CVE-2026-65905 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-68525 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina.",
      "vulnerability": {
        "name": "CVE-2026-68525"
      },
      "action_statement": "Vulnerability CVE-2026-68525 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat-catalina."
    }
  ]
}