{
  "@id": "urn:uuid:c7f95a10-3bcd-4664-a698-2285a23f9347",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 33,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-30T14:48:00.154664+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-websocket@8.5.100-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-websocket@8.5.100-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2020-13935 affects version 8.5.100-tuxcare.7 of org.apache.tomcat:tomcat-websocket.",
      "vulnerability": {
        "name": "CVE-2020-13935"
      },
      "action_statement": "Vulnerability CVE-2020-13935 affects version 8.5.100-tuxcare.7 of org.apache.tomcat:tomcat-websocket."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-websocket@8.5.100-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-websocket@8.5.100-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2022-45143 does not affect version 8.5.100-tuxcare.7 of org.apache.tomcat:tomcat-websocket. Target Tomcat 8.5.100 is not affected by CVE-2022-45143. The vulnerability (unescaped JSON values in JsonErrorReportValve allowing output manipulation) was fixed by upstream Apache commit 0cab3a56bd (Mark Thomas, Nov 2022), which was already included in the Apache Tomcat 8.5.100 release (tagged Mar 2024). The fix adds JSONFilter.escape() calls to sanitize type, message, and description values before embedding them in JSON output. No TuxCare-specific backport was required for 8.5.100 as the fix came from upstream.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-45143"
      },
      "impact_statement": "Target Tomcat 8.5.100 is not affected by CVE-2022-45143. The vulnerability (unescaped JSON values in JsonErrorReportValve allowing output manipulation) was fixed by upstream Apache commit 0cab3a56bd (Mark Thomas, Nov 2022), which was already included in the Apache Tomcat 8.5.100 release (tagged Mar 2024). The fix adds JSONFilter.escape() calls to sanitize type, message, and description values before embedding them in JSON output. No TuxCare-specific backport was required for 8.5.100 as the fix came from upstream."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-websocket@8.5.100-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-websocket@8.5.100-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-28T18:21:18.934330+00:00",
      "status_notes": "Vulnerability CVE-2023-42795 does not affect version 8.5.100-tuxcare.7 of org.apache.tomcat:tomcat-websocket. not_affected \u2014 Target Apache Tomcat 8.5.100 is NOT AFFECTED by CVE-2023-42795. The vulnerability affects versions 8.5.0 through 8.5.93 due to incomplete object recycling when exceptions occur during cleanup, potentially causing information leakage between requests. The fix was committed upstream by Mark Thomas (markt@apache.org) on 2023-10-05 in commit 30f8063d7a and shipped in version 8.5.94. Since the targe...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-42795"
      },
      "impact_statement": "not_affected \u2014 Target Apache Tomcat 8.5.100 is NOT AFFECTED by CVE-2023-42795. The vulnerability affects versions 8.5.0 through 8.5.93 due to incomplete object recycling when exceptions occur during cleanup, potentially causing information leakage between requests. The fix was committed upstream by Mark Thomas (markt@apache.org) on 2023-10-05 in commit 30f8063d7a and shipped in version 8.5.94. Since the targe..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-websocket@8.5.100-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-websocket@8.5.100-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-23672 does not affect version 8.5.100-tuxcare.7 of org.apache.tomcat:tomcat-websocket. not_affected \u2014 Target Apache Tomcat 8.5.100 is NOT vulnerable to CVE-2024-23672. The upstream Apache Tomcat fix for the WebSocket close timeout issue was included in version 8.5.99 (commit 3631adb134 by Mark Thomas), and the target is based on version 8.5.100 which contains this fix. The complete timeout enforcement mechanism is present and functional: sessionCloseTimeoutExpiry tracking, checkCloseTimeout() m...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-23672"
      },
      "impact_statement": "not_affected \u2014 Target Apache Tomcat 8.5.100 is NOT vulnerable to CVE-2024-23672. The upstream Apache Tomcat fix for the WebSocket close timeout issue was included in version 8.5.99 (commit 3631adb134 by Mark Thomas), and the target is based on version 8.5.100 which contains this fix. The complete timeout enforcement mechanism is present and functional: sessionCloseTimeoutExpiry tracking, checkCloseTimeout() m..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-websocket@8.5.100-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-websocket@8.5.100-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-28T21:58:36.804623+00:00",
      "status_notes": "Vulnerability CVE-2026-53434 affects version 8.5.100-tuxcare.7 of org.apache.tomcat:tomcat-websocket.",
      "vulnerability": {
        "name": "CVE-2026-53434"
      },
      "action_statement": "Vulnerability CVE-2026-53434 affects version 8.5.100-tuxcare.7 of org.apache.tomcat:tomcat-websocket."
    }
  ]
}