{
  "@id": "urn:uuid:c358f57a-c94f-4eee-952b-b637143f8f29",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 29,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-30T00:47:50.558433+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-i18n-de@8.5.100-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-i18n-de@8.5.100-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2016-0763 does not affect version 8.5.100-tuxcare.5 of org.apache.tomcat:tomcat-i18n-de. CVE-2016-0763 affects Apache Tomcat 8.x before 8.0.31",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-0763"
      },
      "impact_statement": "CVE-2016-0763 affects Apache Tomcat 8.x before 8.0.31"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-i18n-de@8.5.100-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-i18n-de@8.5.100-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2016-6817 does not affect version 8.5.100-tuxcare.5 of org.apache.tomcat:tomcat-i18n-de. already_fixed \u2014 CVE-2016-6817 affects Apache Tomcat 8.5.0 to 8.5.6 and 9.0.0.M1 to 9.0.0.M11. The target repository is version 8.5.100-tuxcare.10, which already contains the fix that was applied in commit ee091b16f4 on October 20, 2016. The fix implements header size and count limits with exception throwing to prevent the infinite loop vulnerability.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-6817"
      },
      "impact_statement": "already_fixed \u2014 CVE-2016-6817 affects Apache Tomcat 8.5.0 to 8.5.6 and 9.0.0.M1 to 9.0.0.M11. The target repository is version 8.5.100-tuxcare.10, which already contains the fix that was applied in commit ee091b16f4 on October 20, 2016. The fix implements header size and count limits with exception throwing to prevent the infinite loop vulnerability."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-i18n-de@8.5.100-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-i18n-de@8.5.100-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2016-8747 does not affect version 8.5.100-tuxcare.5 of org.apache.tomcat:tomcat-i18n-de. already_fixed \u2014 CVE-2016-8747 is NOT present in the target repository. The target is Apache Tomcat 8.5.100-tuxcare.10, which already contains the fix introduced in version 8.5.10 (December 2016). The vulnerable buffer management code in the nextRequest() method has been replaced with proper buffer state handling that prevents cross-request data leakage.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-8747"
      },
      "impact_statement": "already_fixed \u2014 CVE-2016-8747 is NOT present in the target repository. The target is Apache Tomcat 8.5.100-tuxcare.10, which already contains the fix introduced in version 8.5.10 (December 2016). The vulnerable buffer management code in the nextRequest() method has been replaced with proper buffer state handling that prevents cross-request data leakage."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-i18n-de@8.5.100-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-i18n-de@8.5.100-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2017-5650 does not affect version 8.5.100-tuxcare.5 of org.apache.tomcat:tomcat-i18n-de. already_fixed \u2014 CVE-2017-5650 affects Apache Tomcat 8.5.0 to 8.5.12. The target repository is running Tomcat 8.5.100-tuxcare.10, which is 88 minor versions beyond the affected range. Code analysis confirms the fix is present: when a GOAWAY frame is received, all streams including those waiting for WINDOW_UPDATE are properly closed and their threads are released, preventing thread exhaustion.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-5650"
      },
      "impact_statement": "already_fixed \u2014 CVE-2017-5650 affects Apache Tomcat 8.5.0 to 8.5.12. The target repository is running Tomcat 8.5.100-tuxcare.10, which is 88 minor versions beyond the affected range. Code analysis confirms the fix is present: when a GOAWAY frame is received, all streams including those waiting for WINDOW_UPDATE are properly closed and their threads are released, preventing thread exhaustion."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-i18n-de@8.5.100-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-i18n-de@8.5.100-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2017-7675 does not affect version 8.5.100-tuxcare.5 of org.apache.tomcat:tomcat-i18n-de. already_fixed \u2014 CVE-2017-7675 affects Apache Tomcat's HTTP/2 implementation (versions 8.5.0 to 8.5.15 and 9.0.0.M1 to 9.0.0.M21), allowing directory traversal attacks via specially crafted URLs. The target repository (Tomcat 8.5.100-tuxcare.10) already contains the fix for this vulnerability, applied via Bug 61120 in May 2017.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7675"
      },
      "impact_statement": "already_fixed \u2014 CVE-2017-7675 affects Apache Tomcat's HTTP/2 implementation (versions 8.5.0 to 8.5.15 and 9.0.0.M1 to 9.0.0.M21), allowing directory traversal attacks via specially crafted URLs. The target repository (Tomcat 8.5.100-tuxcare.10) already contains the fix for this vulnerability, applied via Bug 61120 in May 2017."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-i18n-de@8.5.100-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-i18n-de@8.5.100-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-20T12:46:51.138394+00:00",
      "status_notes": "Vulnerability CVE-2020-8022 is a false positive for org.apache.tomcat:tomcat-i18n-de 8.5.100-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2020-8022"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-i18n-de@8.5.100-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-i18n-de@8.5.100-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-34486 affects version 8.5.100-tuxcare.5 of org.apache.tomcat:tomcat-i18n-de, and is fixed in 8.5.100-tuxcare.9.",
      "vulnerability": {
        "name": "CVE-2026-34486"
      },
      "action_statement": "Vulnerability CVE-2026-34486 affects version 8.5.100-tuxcare.5 of org.apache.tomcat:tomcat-i18n-de, and is fixed in 8.5.100-tuxcare.9."
    }
  ]
}