{
  "@id": "urn:uuid:d241d6f6-a5b6-4c9c-8873-220ed4fbb1ef",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 29,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-30T14:49:00.106665+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-util@9.0.87-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-util@9.0.87-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-29T04:08:51.772780+00:00",
      "status_notes": "Vulnerability CVE-2016-8745 affects version 9.0.87-tuxcare.4 of org.apache.tomcat:tomcat-util.",
      "vulnerability": {
        "name": "CVE-2016-8745"
      },
      "action_statement": "Vulnerability CVE-2016-8745 affects version 9.0.87-tuxcare.4 of org.apache.tomcat:tomcat-util."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-util@9.0.87-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-util@9.0.87-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2022-45143 does not affect version 9.0.87-tuxcare.4 of org.apache.tomcat:tomcat-util. CVE-2022-45143 is not a vulnerability in target Tomcat 9.0.87. The upstream Apache vendor fix (commit b336f4e58893ea35114f1e4a415657f723b1298e by Mark Thomas) that adds JSON escaping via JSONFilter.escape() to prevent JSON injection is already present in the target's base 9.0.87 release. All three error report fields (type, message, description) in JsonErrorReportValve are properly escaped before JSON output construction.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-45143"
      },
      "impact_statement": "CVE-2022-45143 is not a vulnerability in target Tomcat 9.0.87. The upstream Apache vendor fix (commit b336f4e58893ea35114f1e4a415657f723b1298e by Mark Thomas) that adds JSON escaping via JSONFilter.escape() to prevent JSON injection is already present in the target's base 9.0.87 release. All three error report fields (type, message, description) in JsonErrorReportValve are properly escaped before JSON output construction."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-util@9.0.87-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-util@9.0.87-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-28T18:21:18.934330+00:00",
      "status_notes": "Vulnerability CVE-2023-42795 does not affect version 9.0.87-tuxcare.4 of org.apache.tomcat:tomcat-util. not_affected \u2014 CVE-2023-42795 is not present in Tomcat 9.0.87. The vulnerability was fixed in upstream Apache Tomcat 9.0.81 (released October 2023), and version 9.0.87 already contains the complete fix. All four protection mechanisms from the upstream patch are present: (1) Request.recycle() wraps part.delete() in try-catch and correctly orders asyncContext nullification, (2) ApplicationHttpRequest.recycle() ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-42795"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-42795 is not present in Tomcat 9.0.87. The vulnerability was fixed in upstream Apache Tomcat 9.0.81 (released October 2023), and version 9.0.87 already contains the complete fix. All four protection mechanisms from the upstream patch are present: (1) Request.recycle() wraps part.delete() in try-catch and correctly orders asyncContext nullification, (2) ApplicationHttpRequest.recycle() ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-util@9.0.87-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-util@9.0.87-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-23T21:50:56.656209+00:00",
      "status_notes": "Vulnerability CVE-2026-53434 affects version 9.0.87-tuxcare.4 of org.apache.tomcat:tomcat-util.",
      "vulnerability": {
        "name": "CVE-2026-53434"
      },
      "action_statement": "Vulnerability CVE-2026-53434 affects version 9.0.87-tuxcare.4 of org.apache.tomcat:tomcat-util."
    }
  ]
}