{
  "@id": "urn:uuid:3a963963-056b-4a19-8ed0-02a4e450194a",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 24,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-30T14:22:27.284985+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-util@8.5.78-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-util@8.5.78-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T10:08:25.772092+00:00",
      "status_notes": "Vulnerability CVE-2016-8745 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-util. CVE-2016-8745 affects Tomcat 8.5.0 to 8.5.8. The target version 8.5.78 already contains the upstream fix from commit 16a57bc885 (Nov 2016) which prevents the Processor object from being added to the cache multiple times during sendfile error handling. The vulnerable code pattern (unconditional cancelledKey calls in error paths) is not present. The fix was authored by upstream Apache and shipped in the 8.5.78 release that TuxCare onboarded.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-8745"
      },
      "impact_statement": "CVE-2016-8745 affects Tomcat 8.5.0 to 8.5.8. The target version 8.5.78 already contains the upstream fix from commit 16a57bc885 (Nov 2016) which prevents the Processor object from being added to the cache multiple times during sendfile error handling. The vulnerable code pattern (unconditional cancelledKey calls in error paths) is not present. The fix was authored by upstream Apache and shipped in the 8.5.78 release that TuxCare onboarded."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-util@8.5.78-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-util@8.5.78-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T10:08:25.772092+00:00",
      "status_notes": "Vulnerability CVE-2022-45143 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-util. CVE-2022-45143 affects JsonErrorReportValve, which does not exist in Tomcat 8.5.78. The vulnerability involves missing JSON escaping in type/message/description fields. The target version only has ErrorReportValve, which generates HTML error reports with proper HTML escaping (Escape.htmlElementContent). JsonErrorReportValve was introduced upstream on 2020-10-14 in versions 8.5.83+, 9.0.40+, and 10.1.0+, never backported to 8.5.78. The attack chain (user-provided error data \u2192 manipulated JSON output) cannot complete because JSON error reporting does not exist in the target. Verdict: not_affected per Rule 5 Type A2 (input received but chain to Goal broken by missing JSON generation).",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2022-45143"
      },
      "impact_statement": "CVE-2022-45143 affects JsonErrorReportValve, which does not exist in Tomcat 8.5.78. The vulnerability involves missing JSON escaping in type/message/description fields. The target version only has ErrorReportValve, which generates HTML error reports with proper HTML escaping (Escape.htmlElementContent). JsonErrorReportValve was introduced upstream on 2020-10-14 in versions 8.5.83+, 9.0.40+, and 10.1.0+, never backported to 8.5.78. The attack chain (user-provided error data \u2192 manipulated JSON output) cannot complete because JSON error reporting does not exist in the target. Verdict: not_affected per Rule 5 Type A2 (input received but chain to Goal broken by missing JSON generation)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-util@8.5.78-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-util@8.5.78-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T10:08:25.772092+00:00",
      "status_notes": "Vulnerability CVE-2023-42795 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-util.",
      "vulnerability": {
        "name": "CVE-2023-42795"
      },
      "action_statement": "Vulnerability CVE-2023-42795 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-util."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-util@8.5.78-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-util@8.5.78-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T21:58:36.804623+00:00",
      "status_notes": "Vulnerability CVE-2026-53434 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-util.",
      "vulnerability": {
        "name": "CVE-2026-53434"
      },
      "action_statement": "Vulnerability CVE-2026-53434 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-util."
    }
  ]
}