{ "@id": "urn:uuid:2f7de5e4-4815-4a9e-b305-0c8ab73da733", "role": "Document Creator", "author": "https://tuxcare.com", "version": 33, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-10-30T14:48:00.154664+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.100-tuxcare.9", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.100-tuxcare.9" } } ], "timestamp": "2026-10-29T07:42:31.773838+00:00", "status_notes": "Vulnerability CVE-2014-0095 affects version 8.5.100-tuxcare.9 of org.apache.tomcat:tomcat-coyote.", "vulnerability": { "name": "CVE-2014-0095" }, "action_statement": "Vulnerability CVE-2014-0095 affects version 8.5.100-tuxcare.9 of org.apache.tomcat:tomcat-coyote." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.100-tuxcare.9", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.100-tuxcare.9" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2016-6816 does not affect version 8.5.100-tuxcare.9 of org.apache.tomcat:tomcat-coyote. Version 8.5.100 is not vulnerable. Summary: The target repository (Tomcat 8.5.100-tuxcare.10) contains the HTTP request line parsing feature described in CVE-2016-6816, but the vendor's fix has been applied. The fix was released in Tomcat 8.5.7, and the target version is much newer.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2016-6816" }, "impact_statement": "Version 8.5.100 is not vulnerable. Summary: The target repository (Tomcat 8.5.100-tuxcare.10) contains the HTTP request line parsing feature described in CVE-2016-6816, but the vendor's fix has been applied. The fix was released in Tomcat 8.5.7, and the target version is much newer." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.100-tuxcare.9", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.100-tuxcare.9" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2017-5651 does not affect version 8.5.100-tuxcare.9 of org.apache.tomcat:tomcat-coyote. CVE-2017-5651 affects Apache Tomcat 8.5.0-8.5.12", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-5651" }, "impact_statement": "CVE-2017-5651 affects Apache Tomcat 8.5.0-8.5.12" }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.100-tuxcare.9", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.100-tuxcare.9" } } ], "timestamp": "2026-10-28T23:33:09.807961+00:00", "status_notes": "Vulnerability CVE-2019-0199 affects version 8.5.100-tuxcare.9 of org.apache.tomcat:tomcat-coyote.", "vulnerability": { "name": "CVE-2019-0199" }, "action_statement": "Vulnerability CVE-2019-0199 affects version 8.5.100-tuxcare.9 of org.apache.tomcat:tomcat-coyote." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.100-tuxcare.9", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.100-tuxcare.9" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-13934 does not affect version 8.5.100-tuxcare.9 of org.apache.tomcat:tomcat-coyote. CVE-2020-13934 affects Apache Tomcat 8.5.1-8.5.56", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-13934" }, "impact_statement": "CVE-2020-13934 affects Apache Tomcat 8.5.1-8.5.56" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.100-tuxcare.9", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.100-tuxcare.9" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-13943 does not affect version 8.5.100-tuxcare.9 of org.apache.tomcat:tomcat-coyote. Version 8.5.100 is not vulnerable. Summary: The target repository is NOT vulnerable to CVE-2020-13943. The security fix has been applied: the concurrent stream limit check has been correctly moved from headersStart() to headersEnd(), preventing HTTP header leakage between requests. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-13943" }, "impact_statement": "Version 8.5.100 is not vulnerable. Summary: The target repository is NOT vulnerable to CVE-2020-13943. The security fix has been applied: the concurrent stream limit check has been correctly moved from headersStart() to headersEnd(), preventing HTTP header leakage between requests. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.100-tuxcare.9", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.100-tuxcare.9" } } ], "timestamp": "2026-10-28T23:59:58.436178+00:00", "status_notes": "Vulnerability CVE-2020-17527 affects version 8.5.100-tuxcare.9 of org.apache.tomcat:tomcat-coyote.", "vulnerability": { "name": "CVE-2020-17527" }, "action_statement": "Vulnerability CVE-2020-17527 affects version 8.5.100-tuxcare.9 of org.apache.tomcat:tomcat-coyote." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.100-tuxcare.9", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.100-tuxcare.9" } } ], "timestamp": "2026-10-29T00:08:54.384014+00:00", "status_notes": "Vulnerability CVE-2021-25122 affects version 8.5.100-tuxcare.9 of org.apache.tomcat:tomcat-coyote.", "vulnerability": { "name": "CVE-2021-25122" }, "action_statement": "Vulnerability CVE-2021-25122 affects version 8.5.100-tuxcare.9 of org.apache.tomcat:tomcat-coyote." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.100-tuxcare.9", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.100-tuxcare.9" } } ], "timestamp": "2026-10-28T21:12:12.887949+00:00", "status_notes": "Vulnerability CVE-2022-42252 affects version 8.5.100-tuxcare.9 of org.apache.tomcat:tomcat-coyote.", "vulnerability": { "name": "CVE-2022-42252" }, "action_statement": "Vulnerability CVE-2022-42252 affects version 8.5.100-tuxcare.9 of org.apache.tomcat:tomcat-coyote." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.100-tuxcare.9", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.100-tuxcare.9" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-45143 does not affect version 8.5.100-tuxcare.9 of org.apache.tomcat:tomcat-coyote. Target Tomcat 8.5.100 is not affected by CVE-2022-45143. The vulnerability (unescaped JSON values in JsonErrorReportValve allowing output manipulation) was fixed by upstream Apache commit 0cab3a56bd (Mark Thomas, Nov 2022), which was already included in the Apache Tomcat 8.5.100 release (tagged Mar 2024). The fix adds JSONFilter.escape() calls to sanitize type, message, and description values before embedding them in JSON output. No TuxCare-specific backport was required for 8.5.100 as the fix came from upstream.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-45143" }, "impact_statement": "Target Tomcat 8.5.100 is not affected by CVE-2022-45143. The vulnerability (unescaped JSON values in JsonErrorReportValve allowing output manipulation) was fixed by upstream Apache commit 0cab3a56bd (Mark Thomas, Nov 2022), which was already included in the Apache Tomcat 8.5.100 release (tagged Mar 2024). The fix adds JSONFilter.escape() calls to sanitize type, message, and description values before embedding them in JSON output. No TuxCare-specific backport was required for 8.5.100 as the fix came from upstream." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.100-tuxcare.9", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.100-tuxcare.9" } } ], "timestamp": "2026-10-28T21:11:34.688190+00:00", "status_notes": "Vulnerability CVE-2023-24998 affects version 8.5.100-tuxcare.9 of org.apache.tomcat:tomcat-coyote.", "vulnerability": { "name": "CVE-2023-24998" }, "action_statement": "Vulnerability CVE-2023-24998 affects version 8.5.100-tuxcare.9 of org.apache.tomcat:tomcat-coyote." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.100-tuxcare.9", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.100-tuxcare.9" } } ], "timestamp": "2026-10-29T01:46:20.750358+00:00", "status_notes": "Vulnerability CVE-2023-28709 affects version 8.5.100-tuxcare.9 of org.apache.tomcat:tomcat-coyote.", "vulnerability": { "name": "CVE-2023-28709" }, "action_statement": "Vulnerability CVE-2023-28709 affects version 8.5.100-tuxcare.9 of org.apache.tomcat:tomcat-coyote." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.100-tuxcare.9", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.100-tuxcare.9" } } ], "timestamp": "2026-10-29T07:42:31.773838+00:00", "status_notes": "Vulnerability CVE-2023-34981 affects version 8.5.100-tuxcare.9 of org.apache.tomcat:tomcat-coyote.", "vulnerability": { "name": "CVE-2023-34981" }, "action_statement": "Vulnerability CVE-2023-34981 affects version 8.5.100-tuxcare.9 of org.apache.tomcat:tomcat-coyote." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.100-tuxcare.9", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.100-tuxcare.9" } } ], "timestamp": "2026-10-28T18:40:55.741562+00:00", "status_notes": "Vulnerability CVE-2023-42794 does not affect version 8.5.100-tuxcare.9 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 CVE-2023-42794 affects Apache Tomcat 8.5.85-8.5.93 due to missing finalize() cleanup in DiskFileItem, causing temporary uploaded files to persist indefinitely when streams aren't properly closed. The target version 8.5.100 includes the upstream fix (commit c99ffc30e9) that restores the finalize() method to delete temporary files during garbage collection. This fix was authored by Mark Thomas (m...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-42794" }, "impact_statement": "not_affected \u2014 CVE-2023-42794 affects Apache Tomcat 8.5.85-8.5.93 due to missing finalize() cleanup in DiskFileItem, causing temporary uploaded files to persist indefinitely when streams aren't properly closed. The target version 8.5.100 includes the upstream fix (commit c99ffc30e9) that restores the finalize() method to delete temporary files during garbage collection. This fix was authored by Mark Thomas (m..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.100-tuxcare.9", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.100-tuxcare.9" } } ], "timestamp": "2026-10-28T18:21:18.934330+00:00", "status_notes": "Vulnerability CVE-2023-42795 does not affect version 8.5.100-tuxcare.9 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 Target Apache Tomcat 8.5.100 is NOT AFFECTED by CVE-2023-42795. The vulnerability affects versions 8.5.0 through 8.5.93 due to incomplete object recycling when exceptions occur during cleanup, potentially causing information leakage between requests. The fix was committed upstream by Mark Thomas (markt@apache.org) on 2023-10-05 in commit 30f8063d7a and shipped in version 8.5.94. Since the targe...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-42795" }, "impact_statement": "not_affected \u2014 Target Apache Tomcat 8.5.100 is NOT AFFECTED by CVE-2023-42795. The vulnerability affects versions 8.5.0 through 8.5.93 due to incomplete object recycling when exceptions occur during cleanup, potentially causing information leakage between requests. The fix was committed upstream by Mark Thomas (markt@apache.org) on 2023-10-05 in commit 30f8063d7a and shipped in version 8.5.94. Since the targe..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.100-tuxcare.9", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.100-tuxcare.9" } } ], "timestamp": "2026-10-28T18:12:53.572239+00:00", "status_notes": "Vulnerability CVE-2023-44487 affects version 8.5.100-tuxcare.9 of org.apache.tomcat:tomcat-coyote.", "vulnerability": { "name": "CVE-2023-44487" }, "action_statement": "Vulnerability CVE-2023-44487 affects version 8.5.100-tuxcare.9 of org.apache.tomcat:tomcat-coyote." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.100-tuxcare.9", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.100-tuxcare.9" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-45648 does not affect version 8.5.100-tuxcare.9 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 Target Apache Tomcat 8.5.100 is NOT vulnerable to CVE-2023-45648. The upstream fix for HTTP trailer header validation was already present in the Apache Tomcat 8.5.100 release that TuxCare onboarded. The fix adds validation to reject non-token characters in trailer header names and control characters (except HT) in trailer header values, preventing request smuggling attacks. Commit c83fe47725f7a...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-45648" }, "impact_statement": "not_affected \u2014 Target Apache Tomcat 8.5.100 is NOT vulnerable to CVE-2023-45648. The upstream fix for HTTP trailer header validation was already present in the Apache Tomcat 8.5.100 release that TuxCare onboarded. The fix adds validation to reject non-token characters in trailer header names and control characters (except HT) in trailer header values, preventing request smuggling attacks. Commit c83fe47725f7a..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.100-tuxcare.9", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.100-tuxcare.9" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability CVE-2023-46589 affects version 8.5.100-tuxcare.9 of org.apache.tomcat:tomcat-coyote.", "vulnerability": { "name": "CVE-2023-46589" }, "action_statement": "Vulnerability CVE-2023-46589 affects version 8.5.100-tuxcare.9 of org.apache.tomcat:tomcat-coyote." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.100-tuxcare.9", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.100-tuxcare.9" } } ], "timestamp": "2026-10-28T23:59:58.436178+00:00", "status_notes": "Vulnerability CVE-2024-21733 affects version 8.5.100-tuxcare.9 of org.apache.tomcat:tomcat-coyote.", "vulnerability": { "name": "CVE-2024-21733" }, "action_statement": "Vulnerability CVE-2024-21733 affects version 8.5.100-tuxcare.9 of org.apache.tomcat:tomcat-coyote." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.100-tuxcare.9", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.100-tuxcare.9" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-24549 does not affect version 8.5.100-tuxcare.9 of org.apache.tomcat:tomcat-coyote. The target (Apache Tomcat 8.5.100-tuxcare.10) is not affected by CVE-2024-24549. The vulnerability was fixed by upstream Apache in commit 0cac540a88 (authored by markt@apache.org on Jan 25, 2024) and included in the Apache Tomcat 8.5.100 release (tagged March 19, 2024). TuxCare adopted version 8.5.100 which already contained the fix. The vulnerable pattern (delayed validation of HTTP/2 headers until all frames are processed) is absent from the target code. CVE affects versions \"8.5.0 through 8.5.98\" and recommends upgrading to 8.5.99+; target is 8.5.100.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-24549" }, "impact_statement": "The target (Apache Tomcat 8.5.100-tuxcare.10) is not affected by CVE-2024-24549. The vulnerability was fixed by upstream Apache in commit 0cac540a88 (authored by markt@apache.org on Jan 25, 2024) and included in the Apache Tomcat 8.5.100 release (tagged March 19, 2024). TuxCare adopted version 8.5.100 which already contained the fix. The vulnerable pattern (delayed validation of HTTP/2 headers until all frames are processed) is absent from the target code. CVE affects versions \"8.5.0 through 8.5.98\" and recommends upgrading to 8.5.99+; target is 8.5.100." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.100-tuxcare.9", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.100-tuxcare.9" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-34750 is fixed in version 8.5.100-tuxcare.9 of org.apache.tomcat:tomcat-coyote.", "vulnerability": { "name": "CVE-2024-34750" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.100-tuxcare.9", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.100-tuxcare.9" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-38286 is fixed in version 8.5.100-tuxcare.9 of org.apache.tomcat:tomcat-coyote.", "vulnerability": { "name": "CVE-2024-38286" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.100-tuxcare.9", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.100-tuxcare.9" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52317 is fixed in version 8.5.100-tuxcare.9 of org.apache.tomcat:tomcat-coyote.", "vulnerability": { "name": "CVE-2024-52317" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.100-tuxcare.9", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.100-tuxcare.9" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31650 is fixed in version 8.5.100-tuxcare.9 of org.apache.tomcat:tomcat-coyote.", "vulnerability": { "name": "CVE-2025-31650" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.100-tuxcare.9", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.100-tuxcare.9" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48989 is fixed in version 8.5.100-tuxcare.9 of org.apache.tomcat:tomcat-coyote.", "vulnerability": { "name": "CVE-2025-48989" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.100-tuxcare.9", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.100-tuxcare.9" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-52434 is fixed in version 8.5.100-tuxcare.9 of org.apache.tomcat:tomcat-coyote.", "vulnerability": { "name": "CVE-2025-52434" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.100-tuxcare.9", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.100-tuxcare.9" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-53506 is fixed in version 8.5.100-tuxcare.9 of org.apache.tomcat:tomcat-coyote.", "vulnerability": { "name": "CVE-2025-53506" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.100-tuxcare.9", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.100-tuxcare.9" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-66614 is fixed in version 8.5.100-tuxcare.9 of org.apache.tomcat:tomcat-coyote.", "vulnerability": { "name": "CVE-2025-66614" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.100-tuxcare.9", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.100-tuxcare.9" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-24733 is fixed in version 8.5.100-tuxcare.9 of org.apache.tomcat:tomcat-coyote.", "vulnerability": { "name": "CVE-2026-24733" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.100-tuxcare.9", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.100-tuxcare.9" } } ], "timestamp": "2026-10-28T21:58:36.804623+00:00", "status_notes": "Vulnerability CVE-2026-24734 affects version 8.5.100-tuxcare.9 of org.apache.tomcat:tomcat-coyote.", "vulnerability": { "name": "CVE-2026-24734" }, "action_statement": "Vulnerability CVE-2026-24734 affects version 8.5.100-tuxcare.9 of org.apache.tomcat:tomcat-coyote." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.100-tuxcare.9", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.100-tuxcare.9" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-24880 affects version 8.5.100-tuxcare.9 of org.apache.tomcat:tomcat-coyote, and is fixed in 8.5.100-tuxcare.10.", "vulnerability": { "name": "CVE-2026-24880" }, "action_statement": "Vulnerability CVE-2026-24880 affects version 8.5.100-tuxcare.9 of org.apache.tomcat:tomcat-coyote, and is fixed in 8.5.100-tuxcare.10." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.100-tuxcare.9", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.100-tuxcare.9" } } ], "timestamp": "2026-10-29T07:42:31.773838+00:00", "status_notes": "Vulnerability CVE-2026-29129 affects version 8.5.100-tuxcare.9 of org.apache.tomcat:tomcat-coyote.", "vulnerability": { "name": "CVE-2026-29129" }, "action_statement": "Vulnerability CVE-2026-29129 affects version 8.5.100-tuxcare.9 of org.apache.tomcat:tomcat-coyote." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.100-tuxcare.9", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.100-tuxcare.9" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32990 affects version 8.5.100-tuxcare.9 of org.apache.tomcat:tomcat-coyote.", "vulnerability": { "name": "CVE-2026-32990" }, "action_statement": "Vulnerability CVE-2026-32990 affects version 8.5.100-tuxcare.9 of org.apache.tomcat:tomcat-coyote." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.100-tuxcare.9", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.100-tuxcare.9" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41293 affects version 8.5.100-tuxcare.9 of org.apache.tomcat:tomcat-coyote.", "vulnerability": { "name": "CVE-2026-41293" }, "action_statement": "Vulnerability CVE-2026-41293 affects version 8.5.100-tuxcare.9 of org.apache.tomcat:tomcat-coyote." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.100-tuxcare.9", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.100-tuxcare.9" } } ], "timestamp": "2026-10-28T21:58:36.804623+00:00", "status_notes": "Vulnerability CVE-2026-53434 affects version 8.5.100-tuxcare.9 of org.apache.tomcat:tomcat-coyote.", "vulnerability": { "name": "CVE-2026-53434" }, "action_statement": "Vulnerability CVE-2026-53434 affects version 8.5.100-tuxcare.9 of org.apache.tomcat:tomcat-coyote." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.100-tuxcare.9", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.100-tuxcare.9" } } ], "timestamp": "2026-10-29T00:29:56.875680+00:00", "status_notes": "Vulnerability CVE-2026-65637 affects version 8.5.100-tuxcare.9 of org.apache.tomcat:tomcat-coyote.", "vulnerability": { "name": "CVE-2026-65637" }, "action_statement": "Vulnerability CVE-2026-65637 affects version 8.5.100-tuxcare.9 of org.apache.tomcat:tomcat-coyote." } ] }