{ "@id": "urn:uuid:6adccbee-09bf-4c9b-bbf6-7fa5ad998446", "role": "Document Creator", "author": "https://tuxcare.com", "version": 20, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-10-29T18:48:55.110121+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-29T07:42:31.773838+00:00", "status_notes": "Vulnerability CVE-2014-0095 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote.", "vulnerability": { "name": "CVE-2014-0095" }, "action_statement": "Vulnerability CVE-2014-0095 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-29T04:08:51.772780+00:00", "status_notes": "Vulnerability CVE-2016-6816 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote.", "vulnerability": { "name": "CVE-2016-6816" }, "action_statement": "Vulnerability CVE-2016-6816 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-29T07:42:31.773838+00:00", "status_notes": "Vulnerability CVE-2017-5651 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote.", "vulnerability": { "name": "CVE-2017-5651" }, "action_statement": "Vulnerability CVE-2017-5651 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-28T23:28:44.006786+00:00", "status_notes": "Vulnerability CVE-2019-0199 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote.", "vulnerability": { "name": "CVE-2019-0199" }, "action_statement": "Vulnerability CVE-2019-0199 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-21T09:35:11.513953+00:00", "status_notes": "Vulnerability CVE-2020-13934 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote.", "vulnerability": { "name": "CVE-2020-13934" }, "action_statement": "Vulnerability CVE-2020-13934 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-21T09:35:11.513953+00:00", "status_notes": "Vulnerability CVE-2020-13943 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote.", "vulnerability": { "name": "CVE-2020-13943" }, "action_statement": "Vulnerability CVE-2020-13943 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-21T09:35:11.513953+00:00", "status_notes": "Vulnerability CVE-2020-17527 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote.", "vulnerability": { "name": "CVE-2020-17527" }, "action_statement": "Vulnerability CVE-2020-17527 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-21T09:35:11.513953+00:00", "status_notes": "Vulnerability CVE-2021-25122 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote.", "vulnerability": { "name": "CVE-2021-25122" }, "action_statement": "Vulnerability CVE-2021-25122 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-21T09:35:11.513953+00:00", "status_notes": "Vulnerability CVE-2022-42252 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote.", "vulnerability": { "name": "CVE-2022-42252" }, "action_statement": "Vulnerability CVE-2022-42252 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-21T09:35:11.513953+00:00", "status_notes": "Vulnerability CVE-2022-45143 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote. Apache Tomcat 9.0.24 is not affected by CVE-2022-45143. The vulnerability concerns JsonErrorReportValve, a component that does not exist in version 9.0.24. JsonErrorReportValve was introduced in Tomcat 9.0.40. Version 9.0.24 only contains ErrorReportValve, which produces HTML error pages and properly escapes user-controlled data using Escape.htmlElementContent(). The CVE's stated affected range (9.0.40 to 9.0.68) accurately reflects when the vulnerable component was introduced.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-45143" }, "impact_statement": "Apache Tomcat 9.0.24 is not affected by CVE-2022-45143. The vulnerability concerns JsonErrorReportValve, a component that does not exist in version 9.0.24. JsonErrorReportValve was introduced in Tomcat 9.0.40. Version 9.0.24 only contains ErrorReportValve, which produces HTML error pages and properly escapes user-controlled data using Escape.htmlElementContent(). The CVE's stated affected range (9.0.40 to 9.0.68) accurately reflects when the vulnerable component was introduced." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-21T09:41:00.085219+00:00", "status_notes": "Vulnerability CVE-2023-24998 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote.", "vulnerability": { "name": "CVE-2023-24998" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-29T01:46:20.750358+00:00", "status_notes": "Vulnerability CVE-2023-28709 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote.", "vulnerability": { "name": "CVE-2023-28709" }, "action_statement": "Vulnerability CVE-2023-28709 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-29T07:42:31.773838+00:00", "status_notes": "Vulnerability CVE-2023-34981 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote.", "vulnerability": { "name": "CVE-2023-34981" }, "action_statement": "Vulnerability CVE-2023-34981 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-28T18:45:57.071664+00:00", "status_notes": "Vulnerability CVE-2023-42794 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 Target version 9.0.24 is NOT AFFECTED by CVE-2023-42794. The vulnerability was introduced in versions 9.0.70-9.0.80 when an \"in progress refactoring\" removed the finalize() cleanup method from DiskFileItem.java. Version 9.0.24 predates this refactoring and still contains the original finalize() method (lines 549-558) that prevents temporary uploaded files from persisting indefinitely. The CVE a...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-42794" }, "impact_statement": "not_affected \u2014 Target version 9.0.24 is NOT AFFECTED by CVE-2023-42794. The vulnerability was introduced in versions 9.0.70-9.0.80 when an \"in progress refactoring\" removed the finalize() cleanup method from DiskFileItem.java. Version 9.0.24 predates this refactoring and still contains the original finalize() method (lines 549-558) that prevents temporary uploaded files from persisting indefinitely. The CVE a..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-21T09:40:00.126735+00:00", "status_notes": "Vulnerability CVE-2023-42795 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote.", "vulnerability": { "name": "CVE-2023-42795" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-21T09:41:00.085219+00:00", "status_notes": "Vulnerability CVE-2023-44487 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote.", "vulnerability": { "name": "CVE-2023-44487" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-21T09:35:11.513953+00:00", "status_notes": "Vulnerability CVE-2023-45648 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote.", "vulnerability": { "name": "CVE-2023-45648" }, "action_statement": "Vulnerability CVE-2023-45648 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-21T09:35:11.513953+00:00", "status_notes": "Vulnerability CVE-2023-46589 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote.", "vulnerability": { "name": "CVE-2023-46589" }, "action_statement": "Vulnerability CVE-2023-46589 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-21T09:35:11.513953+00:00", "status_notes": "Vulnerability CVE-2024-21733 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote.", "vulnerability": { "name": "CVE-2024-21733" }, "action_statement": "Vulnerability CVE-2024-21733 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-21T09:40:00.126735+00:00", "status_notes": "Vulnerability CVE-2024-24549 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote.", "vulnerability": { "name": "CVE-2024-24549" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-21T09:35:11.513953+00:00", "status_notes": "Vulnerability CVE-2024-34750 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote.", "vulnerability": { "name": "CVE-2024-34750" }, "action_statement": "Vulnerability CVE-2024-34750 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-21T09:40:00.126735+00:00", "status_notes": "Vulnerability CVE-2024-38286 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote.", "vulnerability": { "name": "CVE-2024-38286" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-29T07:42:31.773838+00:00", "status_notes": "Vulnerability CVE-2024-52317 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote.", "vulnerability": { "name": "CVE-2024-52317" }, "action_statement": "Vulnerability CVE-2024-52317 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-21T09:35:11.513953+00:00", "status_notes": "Vulnerability CVE-2025-31650 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote. Apache Tomcat 9.0.24 is not affected by CVE-2025-31650. The vulnerability affects HTTP/2 extensible priorities (RFC 9218) support, which was not implemented in this version. The target lacks all vulnerable code paths: PRIORITY_UPDATE frame handling, Priority.parsePriority() method, and priority HTTP header processing. The CVE's affected version range starts at 9.0.76, consistent with RFC 9218 support being added after 9.0.24.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-31650" }, "impact_statement": "Apache Tomcat 9.0.24 is not affected by CVE-2025-31650. The vulnerability affects HTTP/2 extensible priorities (RFC 9218) support, which was not implemented in this version. The target lacks all vulnerable code paths: PRIORITY_UPDATE frame handling, Priority.parsePriority() method, and priority HTTP header processing. The CVE's affected version range starts at 9.0.76, consistent with RFC 9218 support being added after 9.0.24." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-21T09:40:00.126735+00:00", "status_notes": "Vulnerability CVE-2025-48989 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote.", "vulnerability": { "name": "CVE-2025-48989" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-21T09:40:00.126735+00:00", "status_notes": "Vulnerability CVE-2025-52434 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote.", "vulnerability": { "name": "CVE-2025-52434" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-21T09:40:00.126735+00:00", "status_notes": "Vulnerability CVE-2025-53506 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote.", "vulnerability": { "name": "CVE-2025-53506" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-21T09:40:00.126735+00:00", "status_notes": "Vulnerability CVE-2025-66614 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote.", "vulnerability": { "name": "CVE-2025-66614" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-21T09:40:00.126735+00:00", "status_notes": "Vulnerability CVE-2026-24733 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote.", "vulnerability": { "name": "CVE-2026-24733" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-28T21:58:36.804623+00:00", "status_notes": "Vulnerability CVE-2026-24734 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote.", "vulnerability": { "name": "CVE-2026-24734" }, "action_statement": "Vulnerability CVE-2026-24734 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-21T09:35:11.513953+00:00", "status_notes": "Vulnerability CVE-2026-24880 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote.", "vulnerability": { "name": "CVE-2026-24880" }, "action_statement": "Vulnerability CVE-2026-24880 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-29T07:42:31.773838+00:00", "status_notes": "Vulnerability CVE-2026-29129 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote.", "vulnerability": { "name": "CVE-2026-29129" }, "action_statement": "Vulnerability CVE-2026-29129 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-21T09:35:11.513953+00:00", "status_notes": "Vulnerability CVE-2026-32990 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 CVE-2026-32990 affects the checkSni() method in AbstractEndpoint.java, which validates SNI hostnames against protocol-level host headers. This method was introduced by CVE-2025-66614 in Tomcat versions 9.0.113+, 10.1.50+, and 11.0.15+. The current target (version 9.0.24) predates this feature entirely - the checkSni() method, strictSni configuration, and SNI-vs-protocol-hostname validation logi...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-32990" }, "impact_statement": "not_affected \u2014 CVE-2026-32990 affects the checkSni() method in AbstractEndpoint.java, which validates SNI hostnames against protocol-level host headers. This method was introduced by CVE-2025-66614 in Tomcat versions 9.0.113+, 10.1.50+, and 11.0.15+. The current target (version 9.0.24) predates this feature entirely - the checkSni() method, strictSni configuration, and SNI-vs-protocol-hostname validation logi..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-21T09:35:11.513953+00:00", "status_notes": "Vulnerability CVE-2026-41293 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote.", "vulnerability": { "name": "CVE-2026-41293" }, "action_statement": "Vulnerability CVE-2026-41293 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-28T21:58:36.804623+00:00", "status_notes": "Vulnerability CVE-2026-53434 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote.", "vulnerability": { "name": "CVE-2026-53434" }, "action_statement": "Vulnerability CVE-2026-53434 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } } ], "timestamp": "2026-10-29T00:29:56.875680+00:00", "status_notes": "Vulnerability CVE-2026-65637 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote.", "vulnerability": { "name": "CVE-2026-65637" }, "action_statement": "Vulnerability CVE-2026-65637 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } ] }