{
  "@id": "urn:uuid:77e7a2ce-582d-4832-9b37-1809dfd52aab",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 30,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-30T14:48:00.154664+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-websocket@9.0.90-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-websocket@9.0.90-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2020-13935 affects version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat-websocket.",
      "vulnerability": {
        "name": "CVE-2020-13935"
      },
      "action_statement": "Vulnerability CVE-2020-13935 affects version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat-websocket."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-websocket@9.0.90-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-websocket@9.0.90-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2022-45143 does not affect version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat-websocket. 9.0.90 is not vulnerable, as it is\u00a0outside affected range ( >= 9.0.40, < 9.0.69 )",
      "vulnerability": {
        "name": "CVE-2022-45143"
      },
      "impact_statement": "9.0.90 is not vulnerable, as it is\u00a0outside affected range ( >= 9.0.40, < 9.0.69 )"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-websocket@9.0.90-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-websocket@9.0.90-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T18:21:18.934330+00:00",
      "status_notes": "Vulnerability CVE-2023-42795 does not affect version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat-websocket. not_affected \u2014 CVE-2023-42795 affects Apache Tomcat versions 9.0.0-M1 through 9.0.80 due to incomplete cleanup during recycling of internal objects. The target version 9.0.90 already contains the upstream fix (commit 44d05d75d6 by Mark Thomas from October 2023) that was shipped in the Apache Tomcat 9.0.81+ release. All vulnerable patterns have been addressed: part.delete(), session.endAccess(), asyncContext.r...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-42795"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-42795 affects Apache Tomcat versions 9.0.0-M1 through 9.0.80 due to incomplete cleanup during recycling of internal objects. The target version 9.0.90 already contains the upstream fix (commit 44d05d75d6 by Mark Thomas from October 2023) that was shipped in the Apache Tomcat 9.0.81+ release. All vulnerable patterns have been addressed: part.delete(), session.endAccess(), asyncContext.r..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-websocket@9.0.90-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-websocket@9.0.90-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-23672 affects version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat-websocket.",
      "vulnerability": {
        "name": "CVE-2024-23672"
      },
      "action_statement": "Vulnerability CVE-2024-23672 affects version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat-websocket."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-websocket@9.0.90-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-websocket@9.0.90-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-23T21:50:56.656209+00:00",
      "status_notes": "Vulnerability CVE-2026-53434 affects version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat-websocket.",
      "vulnerability": {
        "name": "CVE-2026-53434"
      },
      "action_statement": "Vulnerability CVE-2026-53434 affects version 9.0.90-tuxcare.2 of org.apache.tomcat:tomcat-websocket."
    }
  ]
}