{
  "@id": "urn:uuid:c0174e5b-b577-42ca-b2fe-3b2cc093e01c",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 41,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-30T14:22:27.284985+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability CVE-2008-1947 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2008-1947"
      },
      "action_statement": "Vulnerability CVE-2008-1947 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-30T14:21:53.066702+00:00",
      "status_notes": "Vulnerability CVE-2013-4590 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2013-4590"
      },
      "action_statement": "Vulnerability CVE-2013-4590 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-30T14:21:53.066702+00:00",
      "status_notes": "Vulnerability CVE-2015-5174 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2015-5174"
      },
      "action_statement": "Vulnerability CVE-2015-5174 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-30T14:22:27.284985+00:00",
      "status_notes": "Vulnerability CVE-2015-5346 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2015-5346"
      },
      "action_statement": "Vulnerability CVE-2015-5346 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-30T14:21:53.066702+00:00",
      "status_notes": "Vulnerability CVE-2016-0706 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2016-0706"
      },
      "action_statement": "Vulnerability CVE-2016-0706 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-29T02:36:49.908127+00:00",
      "status_notes": "Vulnerability CVE-2016-0762 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2016-0762"
      },
      "action_statement": "Vulnerability CVE-2016-0762 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-30T14:22:27.284985+00:00",
      "status_notes": "Vulnerability CVE-2016-0763 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2016-0763"
      },
      "action_statement": "Vulnerability CVE-2016-0763 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-29T02:36:49.908127+00:00",
      "status_notes": "Vulnerability CVE-2016-6794 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2016-6794"
      },
      "action_statement": "Vulnerability CVE-2016-6794 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-29T02:36:49.908127+00:00",
      "status_notes": "Vulnerability CVE-2016-6796 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2016-6796"
      },
      "action_statement": "Vulnerability CVE-2016-6796 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-29T02:36:49.908127+00:00",
      "status_notes": "Vulnerability CVE-2016-6797 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2016-6797"
      },
      "action_statement": "Vulnerability CVE-2016-6797 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-30T14:21:53.066702+00:00",
      "status_notes": "Vulnerability CVE-2016-6817 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2016-6817"
      },
      "action_statement": "Vulnerability CVE-2016-6817 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-30T14:22:27.284985+00:00",
      "status_notes": "Vulnerability CVE-2016-8747 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2016-8747"
      },
      "action_statement": "Vulnerability CVE-2016-8747 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-29T02:36:49.908127+00:00",
      "status_notes": "Vulnerability CVE-2017-5647 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2017-5647"
      },
      "action_statement": "Vulnerability CVE-2017-5647 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-30T14:22:27.284985+00:00",
      "status_notes": "Vulnerability CVE-2017-5650 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2017-5650"
      },
      "action_statement": "Vulnerability CVE-2017-5650 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-29T02:36:49.908127+00:00",
      "status_notes": "Vulnerability CVE-2017-5664 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2017-5664"
      },
      "action_statement": "Vulnerability CVE-2017-5664 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-29T02:36:49.908127+00:00",
      "status_notes": "Vulnerability CVE-2017-7674 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2017-7674"
      },
      "action_statement": "Vulnerability CVE-2017-7674 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-30T14:21:53.066702+00:00",
      "status_notes": "Vulnerability CVE-2017-7675 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2017-7675"
      },
      "action_statement": "Vulnerability CVE-2017-7675 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-28T23:37:14.382670+00:00",
      "status_notes": "Vulnerability CVE-2019-0221 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2019-0221"
      },
      "action_statement": "Vulnerability CVE-2019-0221 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability CVE-2019-17569 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2019-17569"
      },
      "action_statement": "Vulnerability CVE-2019-17569 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2020-11996 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2020-11996"
      },
      "action_statement": "Vulnerability CVE-2020-11996 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2020-13934 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2020-13934"
      },
      "action_statement": "Vulnerability CVE-2020-13934 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2020-13935 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2020-13935"
      },
      "action_statement": "Vulnerability CVE-2020-13935 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-28T23:28:44.006786+00:00",
      "status_notes": "Vulnerability CVE-2020-1935 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2020-1935"
      },
      "action_statement": "Vulnerability CVE-2020-1935 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-30T14:09:00.258382+00:00",
      "status_notes": "Vulnerability CVE-2020-8022 is a false positive for org.apache.tomcat:tomcat 10.1.42-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2020-8022"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2021-30639 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2021-30639"
      },
      "action_statement": "Vulnerability CVE-2021-30639 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2021-30640 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2021-30640"
      },
      "action_statement": "Vulnerability CVE-2021-30640 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-30T04:38:00.232609+00:00",
      "status_notes": "Vulnerability CVE-2021-33037 does not affect version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2021-33037 is NOT present in Tomcat 10.1.42-tuxcare.11. All three vulnerability patterns have been fixed by upstream Apache Tomcat before the 10.1.42 release: (1) Transfer-Encoding headers are now processed from HTTP/1.0 clients (not just HTTP/1.1), (2) the \"identity\" encoding is rejected with a 501 response, and (3) requests with chunked encoding not as the final encoding are rejected with...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-33037"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-33037 is NOT present in Tomcat 10.1.42-tuxcare.11. All three vulnerability patterns have been fixed by upstream Apache Tomcat before the 10.1.42 release: (1) Transfer-Encoding headers are now processed from HTTP/1.0 clients (not just HTTP/1.1), (2) the \"identity\" encoding is rejected with a 501 response, and (3) requests with chunked encoding not as the final encoding are rejected with..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2021-41079 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2021-41079"
      },
      "action_statement": "Vulnerability CVE-2021-41079 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-28T21:18:11.261123+00:00",
      "status_notes": "Vulnerability CVE-2021-42340 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2021-42340"
      },
      "action_statement": "Vulnerability CVE-2021-42340 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-30T01:39:41.907898+00:00",
      "status_notes": "Vulnerability CVE-2021-43980 does not affect version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2021-43980 is NOT present in Tomcat 10.1.42-tuxcare.11. The vulnerability, which allowed client connections to share an Http11Processor instance due to non-atomic processor ownership transfer, was fixed by upstream Apache Tomcat (commit 170e0f79 by Mark Thomas) and shipped in the Tomcat 10.1.42 release. The target contains the complete fix: AtomicReference for currentProcessor storage, atom...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-43980"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-43980 is NOT present in Tomcat 10.1.42-tuxcare.11. The vulnerability, which allowed client connections to share an Http11Processor instance due to non-atomic processor ownership transfer, was fixed by upstream Apache Tomcat (commit 170e0f79 by Mark Thomas) and shipped in the Tomcat 10.1.42 release. The target contains the complete fix: AtomicReference for currentProcessor storage, atom..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-28T21:20:09.538096+00:00",
      "status_notes": "Vulnerability CVE-2022-23181 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2022-23181"
      },
      "action_statement": "Vulnerability CVE-2022-23181 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2022-25762 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2022-25762"
      },
      "action_statement": "Vulnerability CVE-2022-25762 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-28T21:16:19.887305+00:00",
      "status_notes": "Vulnerability CVE-2022-29885 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2022-29885"
      },
      "action_statement": "Vulnerability CVE-2022-29885 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-30T01:30:17.926702+00:00",
      "status_notes": "Vulnerability CVE-2022-34305 does not affect version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2022-34305 is not present in Tomcat 10.1.42-tuxcare.11. The XSS vulnerability in the Form authentication example has been fixed by upstream Apache (commit d6251d1cfb by Mark Thomas on 2022-06-23). The fix was already present in the upstream release when TuxCare onboarded version 10.1.42 on 2026-03-11. All user-controlled data (principal attributes, session attributes, role parameters) are n...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-34305"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-34305 is not present in Tomcat 10.1.42-tuxcare.11. The XSS vulnerability in the Form authentication example has been fixed by upstream Apache (commit d6251d1cfb by Mark Thomas on 2022-06-23). The fix was already present in the upstream release when TuxCare onboarded version 10.1.42 on 2026-03-11. All user-controlled data (principal attributes, session attributes, role parameters) are n..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-30T00:51:00.063334+00:00",
      "status_notes": "Vulnerability CVE-2023-41080 does not affect version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2023-41080 (open redirect via protocol-relative URLs in FORM authentication) is NOT present in target version 10.1.42. The fix was already included in the upstream Apache Tomcat 10.1.42 release that TuxCare onboarded. The defense code (lines 766-769 in FormAuthenticator.java) strips consecutive leading slashes from saved request URLs, preventing protocol-relative redirect interpretation (e....",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-41080"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-41080 (open redirect via protocol-relative URLs in FORM authentication) is NOT present in target version 10.1.42. The fix was already included in the upstream Apache Tomcat 10.1.42 release that TuxCare onboarded. The defense code (lines 766-769 in FormAuthenticator.java) strips consecutive leading slashes from saved request URLs, preventing protocol-relative redirect interpretation (e...."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-28T18:22:18.734162+00:00",
      "status_notes": "Vulnerability CVE-2023-42795 does not affect version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2023-42795 is NOT present in the target. The vulnerability involves incomplete cleanup during recycling of internal objects, which could leak information between requests. The upstream Apache Tomcat project fixed this in version 10.1.14 (released October 2023) by adding robust error handling to ensure all recycling steps complete even if exceptions occur. The target version 10.1.42 (release...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-42795"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-42795 is NOT present in the target. The vulnerability involves incomplete cleanup during recycling of internal objects, which could leak information between requests. The upstream Apache Tomcat project fixed this in version 10.1.14 (released October 2023) by adding robust error handling to ensure all recycling steps complete even if exceptions occur. The target version 10.1.42 (release..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-28T19:10:05.488784+00:00",
      "status_notes": "Vulnerability CVE-2023-45648 does not affect version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat. not_affected \u2014 Apache Tomcat 10.1.42 is not affected by CVE-2023-45648. The vulnerability involves improper parsing of HTTP trailer headers that could lead to request smuggling. The fix, which validates that trailer header names contain only token characters and values do not contain control characters (except HT/tab), was already present in the upstream Apache Tomcat 10.1.42 release when TuxCare onboarded it...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-45648"
      },
      "impact_statement": "not_affected \u2014 Apache Tomcat 10.1.42 is not affected by CVE-2023-45648. The vulnerability involves improper parsing of HTTP trailer headers that could lead to request smuggling. The fix, which validates that trailer header names contain only token characters and values do not contain control characters (except HT/tab), was already present in the upstream Apache Tomcat 10.1.42 release when TuxCare onboarded it..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-28T19:13:55.687660+00:00",
      "status_notes": "Vulnerability CVE-2024-54677 does not affect version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat. not_affected \u2014 The target Apache Tomcat 10.1.42-tuxcare.11 is not affected by CVE-2024-54677. All fixes for the uncontrolled resource consumption vulnerability in the examples webapp were already present in the upstream Apache Tomcat 10.1.42 release, which predates the TuxCare onboarding of this version. The vulnerable patterns (unbounded session attribute growth, unbounded shopping cart items) are not presen...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-54677"
      },
      "impact_statement": "not_affected \u2014 The target Apache Tomcat 10.1.42-tuxcare.11 is not affected by CVE-2024-54677. All fixes for the uncontrolled resource consumption vulnerability in the examples webapp were already present in the upstream Apache Tomcat 10.1.42 release, which predates the TuxCare onboarding of this version. The vulnerable patterns (unbounded session attribute growth, unbounded shopping cart items) are not presen..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-28T18:12:53.572239+00:00",
      "status_notes": "Vulnerability CVE-2025-49124 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2025-49124"
      },
      "action_statement": "Vulnerability CVE-2025-49124 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-55752 is fixed in version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2025-55752"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-55754 is fixed in version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2025-55754"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-61795 is fixed in version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2025-61795"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-66614 is fixed in version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2025-66614"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-25854 is fixed in version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-25854"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability CVE-2026-29129 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-29129"
      },
      "action_statement": "Vulnerability CVE-2026-29129 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-29145 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-29145"
      },
      "action_statement": "Vulnerability CVE-2026-29145 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-29146 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat, and is fixed in 10.1.42-tuxcare.7.",
      "vulnerability": {
        "name": "CVE-2026-29146"
      },
      "action_statement": "Vulnerability CVE-2026-29146 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat, and is fixed in 10.1.42-tuxcare.7."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-32990 is fixed in version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-32990"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-34483 is fixed in version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-34483"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-34486 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat, and is fixed in 10.1.42-tuxcare.7.",
      "vulnerability": {
        "name": "CVE-2026-34486"
      },
      "action_statement": "Vulnerability CVE-2026-34486 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat, and is fixed in 10.1.42-tuxcare.7."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-34487 is fixed in version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-34487"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41284 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat, and is fixed in 10.1.42-tuxcare.10.",
      "vulnerability": {
        "name": "CVE-2026-41284"
      },
      "action_statement": "Vulnerability CVE-2026-41284 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat, and is fixed in 10.1.42-tuxcare.10."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41293 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat, and is fixed in 10.1.42-tuxcare.8.",
      "vulnerability": {
        "name": "CVE-2026-41293"
      },
      "action_statement": "Vulnerability CVE-2026-41293 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat, and is fixed in 10.1.42-tuxcare.8."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42498 is fixed in version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-42498"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-43512 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat, and is fixed in 10.1.42-tuxcare.9.",
      "vulnerability": {
        "name": "CVE-2026-43512"
      },
      "action_statement": "Vulnerability CVE-2026-43512 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat, and is fixed in 10.1.42-tuxcare.9."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-43513 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat, and is fixed in 10.1.42-tuxcare.9.",
      "vulnerability": {
        "name": "CVE-2026-43513"
      },
      "action_statement": "Vulnerability CVE-2026-43513 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat, and is fixed in 10.1.42-tuxcare.9."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-43514 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-43514"
      },
      "action_statement": "Vulnerability CVE-2026-43514 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-43515 is fixed in version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-43515"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-22T15:11:53.681251+00:00",
      "status_notes": "Vulnerability CVE-2026-65182 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat, and is fixed in 10.1.42-tuxcare.11.",
      "vulnerability": {
        "name": "CVE-2026-65182"
      },
      "action_statement": "Vulnerability CVE-2026-65182 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat, and is fixed in 10.1.42-tuxcare.11."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-65905 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat, and is fixed in 10.1.42-tuxcare.9.",
      "vulnerability": {
        "name": "CVE-2026-65905"
      },
      "action_statement": "Vulnerability CVE-2026-65905 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat, and is fixed in 10.1.42-tuxcare.9."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.42-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-68525 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat, and is fixed in 10.1.42-tuxcare.9.",
      "vulnerability": {
        "name": "CVE-2026-68525"
      },
      "action_statement": "Vulnerability CVE-2026-68525 affects version 10.1.42-tuxcare.5 of org.apache.tomcat:tomcat, and is fixed in 10.1.42-tuxcare.9."
    }
  ]
}