{
  "@id": "urn:uuid:c89fd637-237b-4823-99ff-51b8bd172b4e",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 43,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-30T14:49:00.106665+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability CVE-2008-1947 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2008-1947"
      },
      "action_statement": "Vulnerability CVE-2008-1947 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T14:22:27.284985+00:00",
      "status_notes": "Vulnerability CVE-2013-4590 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2013-4590"
      },
      "action_statement": "Vulnerability CVE-2013-4590 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T14:21:53.066702+00:00",
      "status_notes": "Vulnerability CVE-2015-5174 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2015-5174"
      },
      "action_statement": "Vulnerability CVE-2015-5174 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T14:22:27.284985+00:00",
      "status_notes": "Vulnerability CVE-2015-5346 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2015-5346"
      },
      "action_statement": "Vulnerability CVE-2015-5346 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T14:22:27.284985+00:00",
      "status_notes": "Vulnerability CVE-2016-0706 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2016-0706"
      },
      "action_statement": "Vulnerability CVE-2016-0706 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T02:36:49.908127+00:00",
      "status_notes": "Vulnerability CVE-2016-0762 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2016-0762"
      },
      "action_statement": "Vulnerability CVE-2016-0762 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T14:22:27.284985+00:00",
      "status_notes": "Vulnerability CVE-2016-0763 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2016-0763"
      },
      "action_statement": "Vulnerability CVE-2016-0763 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T02:36:49.908127+00:00",
      "status_notes": "Vulnerability CVE-2016-6794 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2016-6794"
      },
      "action_statement": "Vulnerability CVE-2016-6794 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T02:36:49.908127+00:00",
      "status_notes": "Vulnerability CVE-2016-6796 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2016-6796"
      },
      "action_statement": "Vulnerability CVE-2016-6796 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T02:36:49.908127+00:00",
      "status_notes": "Vulnerability CVE-2016-6797 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2016-6797"
      },
      "action_statement": "Vulnerability CVE-2016-6797 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T14:21:53.066702+00:00",
      "status_notes": "Vulnerability CVE-2016-6817 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2016-6817"
      },
      "action_statement": "Vulnerability CVE-2016-6817 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T14:22:27.284985+00:00",
      "status_notes": "Vulnerability CVE-2016-8747 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2016-8747"
      },
      "action_statement": "Vulnerability CVE-2016-8747 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T02:36:49.908127+00:00",
      "status_notes": "Vulnerability CVE-2017-5647 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2017-5647"
      },
      "action_statement": "Vulnerability CVE-2017-5647 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T14:22:27.284985+00:00",
      "status_notes": "Vulnerability CVE-2017-5650 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2017-5650"
      },
      "action_statement": "Vulnerability CVE-2017-5650 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T02:36:49.908127+00:00",
      "status_notes": "Vulnerability CVE-2017-5664 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2017-5664"
      },
      "action_statement": "Vulnerability CVE-2017-5664 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T02:36:49.908127+00:00",
      "status_notes": "Vulnerability CVE-2017-7674 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2017-7674"
      },
      "action_statement": "Vulnerability CVE-2017-7674 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T14:21:53.066702+00:00",
      "status_notes": "Vulnerability CVE-2017-7675 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2017-7675"
      },
      "action_statement": "Vulnerability CVE-2017-7675 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:37:14.382670+00:00",
      "status_notes": "Vulnerability CVE-2019-0221 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2019-0221"
      },
      "action_statement": "Vulnerability CVE-2019-0221 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability CVE-2019-17569 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2019-17569"
      },
      "action_statement": "Vulnerability CVE-2019-17569 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2020-11996 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2020-11996"
      },
      "action_statement": "Vulnerability CVE-2020-11996 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2020-13934 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2020-13934"
      },
      "action_statement": "Vulnerability CVE-2020-13934 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2020-13935 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2020-13935"
      },
      "action_statement": "Vulnerability CVE-2020-13935 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:33:09.807961+00:00",
      "status_notes": "Vulnerability CVE-2020-1935 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2020-1935"
      },
      "action_statement": "Vulnerability CVE-2020-1935 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T14:10:00.131690+00:00",
      "status_notes": "Vulnerability CVE-2020-8022 is a false positive for org.apache.tomcat:tomcat 10.1.33-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2020-8022"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2021-30639 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2021-30639"
      },
      "action_statement": "Vulnerability CVE-2021-30639 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2021-30640 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2021-30640"
      },
      "action_statement": "Vulnerability CVE-2021-30640 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T04:39:00.135116+00:00",
      "status_notes": "Vulnerability CVE-2021-33037 does not affect version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2021-33037 is not present in Apache Tomcat 10.1.33. All three vulnerability patterns have been fixed by upstream Apache commits that shipped in the 10.1.33 release: (1) Transfer-Encoding headers are now processed from HTTP/1.0 clients via !http09 check, (2) the \"identity\" encoding is rejected with 501 response, and (3) chunked encoding is enforced as the final encoding via contentDelimitati...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-33037"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-33037 is not present in Apache Tomcat 10.1.33. All three vulnerability patterns have been fixed by upstream Apache commits that shipped in the 10.1.33 release: (1) Transfer-Encoding headers are now processed from HTTP/1.0 clients via !http09 check, (2) the \"identity\" encoding is rejected with 501 response, and (3) chunked encoding is enforced as the final encoding via contentDelimitati..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2021-41079 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2021-41079"
      },
      "action_statement": "Vulnerability CVE-2021-41079 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T21:18:11.261123+00:00",
      "status_notes": "Vulnerability CVE-2021-42340 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2021-42340"
      },
      "action_statement": "Vulnerability CVE-2021-42340 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T01:43:00.177812+00:00",
      "status_notes": "Vulnerability CVE-2021-43980 does not affect version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2021-43980 is NOT present in Apache Tomcat 10.1.33. The vulnerability (a concurrency bug allowing processor instance sharing between client connections) was fixed by upstream Apache in commit 17f177ee on March 29, 2022. This fix was already present in the upstream Tomcat 10.1.33 release when TuxCare onboarded it. The target code shows the fixed state: currentProcessor uses AtomicReference w...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-43980"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-43980 is NOT present in Apache Tomcat 10.1.33. The vulnerability (a concurrency bug allowing processor instance sharing between client connections) was fixed by upstream Apache in commit 17f177ee on March 29, 2022. This fix was already present in the upstream Tomcat 10.1.33 release when TuxCare onboarded it. The target code shows the fixed state: currentProcessor uses AtomicReference w..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T21:20:09.538096+00:00",
      "status_notes": "Vulnerability CVE-2022-23181 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2022-23181"
      },
      "action_statement": "Vulnerability CVE-2022-23181 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2022-25762 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2022-25762"
      },
      "action_statement": "Vulnerability CVE-2022-25762 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T21:16:19.887305+00:00",
      "status_notes": "Vulnerability CVE-2022-29885 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2022-29885"
      },
      "action_statement": "Vulnerability CVE-2022-29885 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T01:31:00.193594+00:00",
      "status_notes": "Vulnerability CVE-2022-34305 does not affect version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2022-34305 XSS vulnerability is NOT present in Apache Tomcat 10.1.33. The fix was already included in the upstream release that TuxCare onboarded. All user-controllable data in the form authentication example (session attributes, Principal attributes, role parameter) is properly escaped with util.HTMLFilter.filter() before display, preventing XSS attacks. Fix commit d6251d1cfb by upstream a...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-34305"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-34305 XSS vulnerability is NOT present in Apache Tomcat 10.1.33. The fix was already included in the upstream release that TuxCare onboarded. All user-controllable data in the form authentication example (session attributes, Principal attributes, role parameter) is properly escaped with util.HTMLFilter.filter() before display, preventing XSS attacks. Fix commit d6251d1cfb by upstream a..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T00:52:46.305817+00:00",
      "status_notes": "Vulnerability CVE-2023-41080 does not affect version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2023-41080 (Open Redirect in FORM authentication) is not present in Tomcat 10.1.33. The fix preventing protocol-relative redirects was already included in the upstream Apache Tomcat 10.1.33 release that TuxCare onboarded. The vulnerable pattern never existed in this version.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-41080"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-41080 (Open Redirect in FORM authentication) is not present in Tomcat 10.1.33. The fix preventing protocol-relative redirects was already included in the upstream Apache Tomcat 10.1.33 release that TuxCare onboarded. The vulnerable pattern never existed in this version."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T18:25:14.318468+00:00",
      "status_notes": "Vulnerability CVE-2023-42795 does not affect version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat. not_affected \u2014 Target version 10.1.33 is NOT affected by CVE-2023-42795. The vulnerability affects Tomcat 10.1.0-M1 through 10.1.13, and was fixed in 10.1.14 onwards. The upstream Apache Tomcat fix (commit 30f8063d7a by Mark Thomas, dated Oct 5, 2023) was already present in the 10.1.33 release when TuxCare onboarded it. All four affected files (Request.java, ApplicationHttpRequest.java, B2CConverter.java, C2B...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-42795"
      },
      "impact_statement": "not_affected \u2014 Target version 10.1.33 is NOT affected by CVE-2023-42795. The vulnerability affects Tomcat 10.1.0-M1 through 10.1.13, and was fixed in 10.1.14 onwards. The upstream Apache Tomcat fix (commit 30f8063d7a by Mark Thomas, dated Oct 5, 2023) was already present in the 10.1.33 release when TuxCare onboarded it. All four affected files (Request.java, ApplicationHttpRequest.java, B2CConverter.java, C2B..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T19:11:13.689447+00:00",
      "status_notes": "Vulnerability CVE-2023-45648 does not affect version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2023-45648 is NOT present in Tomcat 10.1.33. The vulnerability required improper parsing of HTTP trailer headers that could lead to request smuggling. The upstream Apache Tomcat project fixed this in October 2023 and subsequently refactored the code in April 2024 to use a centralized HttpHeaderParser class. Version 10.1.33, released November 2024, shipped with the fix already present. The r...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-45648"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-45648 is NOT present in Tomcat 10.1.33. The vulnerability required improper parsing of HTTP trailer headers that could lead to request smuggling. The upstream Apache Tomcat project fixed this in October 2023 and subsequently refactored the code in April 2024 to use a centralized HttpHeaderParser class. Version 10.1.33, released November 2024, shipped with the fix already present. The r..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T10:46:51.248735+00:00",
      "status_notes": "Vulnerability CVE-2024-54677 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2024-54677"
      },
      "action_statement": "Vulnerability CVE-2024-54677 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T10:46:51.248735+00:00",
      "status_notes": "Vulnerability CVE-2025-49124 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2025-49124"
      },
      "action_statement": "Vulnerability CVE-2025-49124 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T10:46:51.248735+00:00",
      "status_notes": "Vulnerability CVE-2025-55752 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2025-55752"
      },
      "action_statement": "Vulnerability CVE-2025-55752 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T10:48:00.134099+00:00",
      "status_notes": "Vulnerability CVE-2025-55754 is fixed in version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2025-55754"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T10:48:00.134099+00:00",
      "status_notes": "Vulnerability CVE-2025-61795 is fixed in version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2025-61795"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T10:46:51.248735+00:00",
      "status_notes": "Vulnerability CVE-2025-66614 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2025-66614"
      },
      "action_statement": "Vulnerability CVE-2025-66614 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T10:48:00.134099+00:00",
      "status_notes": "Vulnerability CVE-2026-25854 is fixed in version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-25854"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability CVE-2026-29129 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-29129"
      },
      "action_statement": "Vulnerability CVE-2026-29129 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T10:48:00.134099+00:00",
      "status_notes": "Vulnerability CVE-2026-29145 is fixed in version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-29145"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T10:46:51.248735+00:00",
      "status_notes": "Vulnerability CVE-2026-29146 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-29146"
      },
      "action_statement": "Vulnerability CVE-2026-29146 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T10:46:51.248735+00:00",
      "status_notes": "Vulnerability CVE-2026-32990 does not affect version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat. not_affected \u2014 Target version 10.1.33 is NOT AFFECTED by CVE-2026-32990. The vulnerable code pattern (the checkSni method with improper protocol hostname normalization) does not exist in this version. The vulnerability was introduced in later versions (10.1.50-10.1.52) when the strict SNI validation feature was added via CVE-2025-66614's fix, and the incomplete normalization in that new code created CVE-2026-...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-32990"
      },
      "impact_statement": "not_affected \u2014 Target version 10.1.33 is NOT AFFECTED by CVE-2026-32990. The vulnerable code pattern (the checkSni method with improper protocol hostname normalization) does not exist in this version. The vulnerability was introduced in later versions (10.1.50-10.1.52) when the strict SNI validation feature was added via CVE-2025-66614's fix, and the incomplete normalization in that new code created CVE-2026-..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T10:46:51.248735+00:00",
      "status_notes": "Vulnerability CVE-2026-34483 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-34483"
      },
      "action_statement": "Vulnerability CVE-2026-34483 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T14:49:00.106665+00:00",
      "status_notes": "Vulnerability CVE-2026-34486 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-34486"
      },
      "action_statement": "Vulnerability CVE-2026-34486 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T10:48:00.134099+00:00",
      "status_notes": "Vulnerability CVE-2026-34487 is fixed in version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-34487"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T10:48:00.134099+00:00",
      "status_notes": "Vulnerability CVE-2026-41284 is fixed in version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-41284"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T10:48:00.134099+00:00",
      "status_notes": "Vulnerability CVE-2026-41293 is fixed in version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-41293"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T10:48:00.134099+00:00",
      "status_notes": "Vulnerability CVE-2026-42498 is fixed in version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-42498"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T10:48:00.134099+00:00",
      "status_notes": "Vulnerability CVE-2026-43512 is fixed in version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-43512"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T10:46:51.248735+00:00",
      "status_notes": "Vulnerability CVE-2026-43513 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-43513"
      },
      "action_statement": "Vulnerability CVE-2026-43513 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T10:46:51.248735+00:00",
      "status_notes": "Vulnerability CVE-2026-43514 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-43514"
      },
      "action_statement": "Vulnerability CVE-2026-43514 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T15:44:53.815373+00:00",
      "status_notes": "Vulnerability CVE-2026-43515 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat, and is fixed in 10.1.33-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-43515"
      },
      "action_statement": "Vulnerability CVE-2026-43515 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat, and is fixed in 10.1.33-tuxcare.2."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T10:48:00.134099+00:00",
      "status_notes": "Vulnerability CVE-2026-65182 is fixed in version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-65182"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T15:44:53.815373+00:00",
      "status_notes": "Vulnerability CVE-2026-65905 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat, and is fixed in 10.1.33-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-65905"
      },
      "action_statement": "Vulnerability CVE-2026-65905 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat, and is fixed in 10.1.33-tuxcare.2."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.33-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T10:48:00.134099+00:00",
      "status_notes": "Vulnerability CVE-2026-68525 is fixed in version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-68525"
      }
    }
  ]
}