{
  "@id": "urn:uuid:83b9f97c-7460-463b-b720-8daec1fd6f91",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 29,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-30T14:49:00.106665+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-websocket@9.0.87-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-websocket@9.0.87-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2020-13935 affects version 9.0.87-tuxcare.1 of org.apache.tomcat:tomcat-websocket.",
      "vulnerability": {
        "name": "CVE-2020-13935"
      },
      "action_statement": "Vulnerability CVE-2020-13935 affects version 9.0.87-tuxcare.1 of org.apache.tomcat:tomcat-websocket."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-websocket@9.0.87-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-websocket@9.0.87-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2022-45143 does not affect version 9.0.87-tuxcare.1 of org.apache.tomcat:tomcat-websocket. CVE-2022-45143 is not a vulnerability in target Tomcat 9.0.87. The upstream Apache vendor fix (commit b336f4e58893ea35114f1e4a415657f723b1298e by Mark Thomas) that adds JSON escaping via JSONFilter.escape() to prevent JSON injection is already present in the target's base 9.0.87 release. All three error report fields (type, message, description) in JsonErrorReportValve are properly escaped before JSON output construction.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-45143"
      },
      "impact_statement": "CVE-2022-45143 is not a vulnerability in target Tomcat 9.0.87. The upstream Apache vendor fix (commit b336f4e58893ea35114f1e4a415657f723b1298e by Mark Thomas) that adds JSON escaping via JSONFilter.escape() to prevent JSON injection is already present in the target's base 9.0.87 release. All three error report fields (type, message, description) in JsonErrorReportValve are properly escaped before JSON output construction."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-websocket@9.0.87-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-websocket@9.0.87-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T18:21:18.934330+00:00",
      "status_notes": "Vulnerability CVE-2023-42795 does not affect version 9.0.87-tuxcare.1 of org.apache.tomcat:tomcat-websocket. not_affected \u2014 CVE-2023-42795 is not present in Tomcat 9.0.87. The vulnerability was fixed in upstream Apache Tomcat 9.0.81 (released October 2023), and version 9.0.87 already contains the complete fix. All four protection mechanisms from the upstream patch are present: (1) Request.recycle() wraps part.delete() in try-catch and correctly orders asyncContext nullification, (2) ApplicationHttpRequest.recycle() ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-42795"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-42795 is not present in Tomcat 9.0.87. The vulnerability was fixed in upstream Apache Tomcat 9.0.81 (released October 2023), and version 9.0.87 already contains the complete fix. All four protection mechanisms from the upstream patch are present: (1) Request.recycle() wraps part.delete() in try-catch and correctly orders asyncContext nullification, (2) ApplicationHttpRequest.recycle() ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-websocket@9.0.87-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-websocket@9.0.87-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-23672 does not affect version 9.0.87-tuxcare.1 of org.apache.tomcat:tomcat-websocket. not_affected \u2014 Target Tomcat 9.0.87-tuxcare.6 is NOT affected by CVE-2024-23672. The vulnerability (incomplete cleanup of WebSocket sessions when clients fail to respond to server close messages) was fixed in upstream Apache Tomcat 9.0.86. The fix (commit 52d6650e06 by Mark Thomas) was already included in the upstream 9.0.87 release upon which the TuxCare 9.0.87-tuxcare.X branch series is based. The current H...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-23672"
      },
      "impact_statement": "not_affected \u2014 Target Tomcat 9.0.87-tuxcare.6 is NOT affected by CVE-2024-23672. The vulnerability (incomplete cleanup of WebSocket sessions when clients fail to respond to server close messages) was fixed in upstream Apache Tomcat 9.0.86. The fix (commit 52d6650e06 by Mark Thomas) was already included in the upstream 9.0.87 release upon which the TuxCare 9.0.87-tuxcare.X branch series is based. The current H..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-websocket@9.0.87-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-websocket@9.0.87-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-23T21:50:56.656209+00:00",
      "status_notes": "Vulnerability CVE-2026-53434 affects version 9.0.87-tuxcare.1 of org.apache.tomcat:tomcat-websocket.",
      "vulnerability": {
        "name": "CVE-2026-53434"
      },
      "action_statement": "Vulnerability CVE-2026-53434 affects version 9.0.87-tuxcare.1 of org.apache.tomcat:tomcat-websocket."
    }
  ]
}