{ "@id": "urn:uuid:e8e421fd-cc4c-4946-b2a0-f04584a43e9c", "role": "Document Creator", "author": "https://tuxcare.com", "version": 33, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-10-30T14:22:27.284985+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2" } } ], "timestamp": "2026-10-29T07:42:31.773838+00:00", "status_notes": "Vulnerability CVE-2008-1947 affects version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2008-1947" }, "action_statement": "Vulnerability CVE-2008-1947 affects version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2" } } ], "timestamp": "2026-10-30T14:21:53.066702+00:00", "status_notes": "Vulnerability CVE-2013-4590 affects version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2013-4590" }, "action_statement": "Vulnerability CVE-2013-4590 affects version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2" } } ], "timestamp": "2026-10-30T14:21:53.066702+00:00", "status_notes": "Vulnerability CVE-2015-5174 affects version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2015-5174" }, "action_statement": "Vulnerability CVE-2015-5174 affects version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2" } } ], "timestamp": "2026-10-30T14:22:27.284985+00:00", "status_notes": "Vulnerability CVE-2015-5346 affects version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2015-5346" }, "action_statement": "Vulnerability CVE-2015-5346 affects version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2" } } ], "timestamp": "2026-10-30T14:21:53.066702+00:00", "status_notes": "Vulnerability CVE-2016-0706 affects version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2016-0706" }, "action_statement": "Vulnerability CVE-2016-0706 affects version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2016-0762 does not affect version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat. already_fixed \u2014 CVE-2016-0762 timing attack vulnerability has been mitigated in this Apache Tomcat 8.5.100 repository. The fix adds password processing even when usernames don't exist, preventing timing-based user enumeration attacks in basic authentication.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2016-0762" }, "impact_statement": "already_fixed \u2014 CVE-2016-0762 timing attack vulnerability has been mitigated in this Apache Tomcat 8.5.100 repository. The fix adds password processing even when usernames don't exist, preventing timing-based user enumeration attacks in basic authentication." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2016-0763 does not affect version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat. CVE-2016-0763 affects Apache Tomcat 8.x before 8.0.31", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2016-0763" }, "impact_statement": "CVE-2016-0763 affects Apache Tomcat 8.x before 8.0.31" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2016-6794 does not affect version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat. CVE-2016-6794 affects Apache Tomcat 8.5.0-8.5.4", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2016-6794" }, "impact_statement": "CVE-2016-6794 affects Apache Tomcat 8.5.0-8.5.4" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2016-6796 does not affect version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat. already_fixed \u2014 CVE-2016-6796 is NOT present in this target. The target repository is Apache Tomcat 8.5.100-tuxcare.10, which is significantly higher than the affected version range (8.5.0 to 8.5.4). The security fix that prevents SecurityManager bypass via JSP Servlet configuration manipulation is present in the code at JspServlet.java lines 92-96.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2016-6796" }, "impact_statement": "already_fixed \u2014 CVE-2016-6796 is NOT present in this target. The target repository is Apache Tomcat 8.5.100-tuxcare.10, which is significantly higher than the affected version range (8.5.0 to 8.5.4). The security fix that prevents SecurityManager bypass via JSP Servlet configuration manipulation is present in the code at JspServlet.java lines 92-96." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2016-6797 does not affect version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat. already_fixed \u2014 CVE-2016-6797 has been fixed in this repository. The vulnerability allowed web applications to access any global JNDI resource without explicit ResourceLink configuration. The fix was introduced in commit d6b5600afe (August 22, 2016) and implements an allowlist-based access control mechanism in ResourceLinkFactory.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2016-6797" }, "impact_statement": "already_fixed \u2014 CVE-2016-6797 has been fixed in this repository. The vulnerability allowed web applications to access any global JNDI resource without explicit ResourceLink configuration. The fix was introduced in commit d6b5600afe (August 22, 2016) and implements an allowlist-based access control mechanism in ResourceLinkFactory." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2016-6817 does not affect version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat. already_fixed \u2014 CVE-2016-6817 affects Apache Tomcat 8.5.0 to 8.5.6 and 9.0.0.M1 to 9.0.0.M11. The target repository is version 8.5.100-tuxcare.10, which already contains the fix that was applied in commit ee091b16f4 on October 20, 2016. The fix implements header size and count limits with exception throwing to prevent the infinite loop vulnerability.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2016-6817" }, "impact_statement": "already_fixed \u2014 CVE-2016-6817 affects Apache Tomcat 8.5.0 to 8.5.6 and 9.0.0.M1 to 9.0.0.M11. The target repository is version 8.5.100-tuxcare.10, which already contains the fix that was applied in commit ee091b16f4 on October 20, 2016. The fix implements header size and count limits with exception throwing to prevent the infinite loop vulnerability." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2016-8747 does not affect version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat. already_fixed \u2014 CVE-2016-8747 is NOT present in the target repository. The target is Apache Tomcat 8.5.100-tuxcare.10, which already contains the fix introduced in version 8.5.10 (December 2016). The vulnerable buffer management code in the nextRequest() method has been replaced with proper buffer state handling that prevents cross-request data leakage.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2016-8747" }, "impact_statement": "already_fixed \u2014 CVE-2016-8747 is NOT present in the target repository. The target is Apache Tomcat 8.5.100-tuxcare.10, which already contains the fix introduced in version 8.5.10 (December 2016). The vulnerable buffer management code in the nextRequest() method has been replaced with proper buffer state handling that prevents cross-request data leakage." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2017-5647 does not affect version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat. CVE-2017-5647 affects Apache Tomcat 8.5.0-8.5.12", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-5647" }, "impact_statement": "CVE-2017-5647 affects Apache Tomcat 8.5.0-8.5.12" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2017-5650 does not affect version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat. already_fixed \u2014 CVE-2017-5650 affects Apache Tomcat 8.5.0 to 8.5.12. The target repository is running Tomcat 8.5.100-tuxcare.10, which is 88 minor versions beyond the affected range. Code analysis confirms the fix is present: when a GOAWAY frame is received, all streams including those waiting for WINDOW_UPDATE are properly closed and their threads are released, preventing thread exhaustion.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-5650" }, "impact_statement": "already_fixed \u2014 CVE-2017-5650 affects Apache Tomcat 8.5.0 to 8.5.12. The target repository is running Tomcat 8.5.100-tuxcare.10, which is 88 minor versions beyond the affected range. Code analysis confirms the fix is present: when a GOAWAY frame is received, all streams including those waiting for WINDOW_UPDATE are properly closed and their threads are released, preventing thread exhaustion." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2017-5664 does not affect version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat. already_fixed \u2014 The target repository (Apache Tomcat 8.5.100-tuxcare.10) already contains the fix for CVE-2017-5664. The DefaultServlet.service() method forces all error-dispatched requests to be processed as GET requests, preventing PUT/DELETE operations on static error pages.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-5664" }, "impact_statement": "already_fixed \u2014 The target repository (Apache Tomcat 8.5.100-tuxcare.10) already contains the fix for CVE-2017-5664. The DefaultServlet.service() method forces all error-dispatched requests to be processed as GET requests, preventing PUT/DELETE operations on static error pages." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2017-7674 does not affect version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat. already_fixed \u2014 CVE-2017-7674 has already been fixed in this Tomcat version. The CORS Filter now correctly adds the HTTP Vary header when specific origins are configured, preventing cache poisoning attacks.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-7674" }, "impact_statement": "already_fixed \u2014 CVE-2017-7674 has already been fixed in this Tomcat version. The CORS Filter now correctly adds the HTTP Vary header when specific origins are configured, preventing cache poisoning attacks." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2017-7675 does not affect version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat. already_fixed \u2014 CVE-2017-7675 affects Apache Tomcat's HTTP/2 implementation (versions 8.5.0 to 8.5.15 and 9.0.0.M1 to 9.0.0.M21), allowing directory traversal attacks via specially crafted URLs. The target repository (Tomcat 8.5.100-tuxcare.10) already contains the fix for this vulnerability, applied via Bug 61120 in May 2017.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-7675" }, "impact_statement": "already_fixed \u2014 CVE-2017-7675 affects Apache Tomcat's HTTP/2 implementation (versions 8.5.0 to 8.5.15 and 9.0.0.M1 to 9.0.0.M21), allowing directory traversal attacks via specially crafted URLs. The target repository (Tomcat 8.5.100-tuxcare.10) already contains the fix for this vulnerability, applied via Bug 61120 in May 2017." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2" } } ], "timestamp": "2026-10-28T23:37:14.382670+00:00", "status_notes": "Vulnerability CVE-2019-0221 affects version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2019-0221" }, "action_statement": "Vulnerability CVE-2019-0221 affects version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2" } } ], "timestamp": "2026-10-29T07:42:31.773838+00:00", "status_notes": "Vulnerability CVE-2019-17569 affects version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2019-17569" }, "action_statement": "Vulnerability CVE-2019-17569 affects version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-11996 does not affect version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat. Version 8.5.100 is not vulnerable. Summary: The target repository is NOT vulnerable to CVE-2020-11996. The vulnerability has been fixed with an optimized implementation that uses ConcurrentNavigableMap.subMap() instead of the vulnerable loop pattern. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11996" }, "impact_statement": "Version 8.5.100 is not vulnerable. Summary: The target repository is NOT vulnerable to CVE-2020-11996. The vulnerability has been fixed with an optimized implementation that uses ConcurrentNavigableMap.subMap() instead of the vulnerable loop pattern. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-13934 does not affect version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat. CVE-2020-13934 affects Apache Tomcat 8.5.1-8.5.56", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-13934" }, "impact_statement": "CVE-2020-13934 affects Apache Tomcat 8.5.1-8.5.56" }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2" } } ], "timestamp": "2026-10-28T23:59:58.436178+00:00", "status_notes": "Vulnerability CVE-2020-13935 affects version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2020-13935" }, "action_statement": "Vulnerability CVE-2020-13935 affects version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2" } } ], "timestamp": "2026-10-28T23:33:09.807961+00:00", "status_notes": "Vulnerability CVE-2020-1935 affects version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2020-1935" }, "action_statement": "Vulnerability CVE-2020-1935 affects version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2020-8022 is a false positive for org.apache.tomcat:tomcat 8.5.100.tuxcare.2.", "vulnerability": { "name": "CVE-2020-8022" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2" } } ], "timestamp": "2026-10-28T23:59:58.436178+00:00", "status_notes": "Vulnerability CVE-2021-30639 affects version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2021-30639" }, "action_statement": "Vulnerability CVE-2021-30639 affects version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2" } } ], "timestamp": "2026-10-28T23:59:58.436178+00:00", "status_notes": "Vulnerability CVE-2021-30640 affects version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2021-30640" }, "action_statement": "Vulnerability CVE-2021-30640 affects version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2" } } ], "timestamp": "2026-10-30T04:33:00.174613+00:00", "status_notes": "Vulnerability CVE-2021-33037 does not affect version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2021-33037 is NOT present in Tomcat 8.5.100. All three vulnerability patterns described in the CVE have been fixed by upstream Apache Tomcat commits that were already included in the 8.5.100 release before TuxCare adoption. The CVE affected versions 8.5.0 to 8.5.66; version 8.5.100 includes upstream fixes from Mark Thomas (markt@apache.org) that: (1) process Transfer-Encoding headers from H...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-33037" }, "impact_statement": "not_affected \u2014 CVE-2021-33037 is NOT present in Tomcat 8.5.100. All three vulnerability patterns described in the CVE have been fixed by upstream Apache Tomcat commits that were already included in the 8.5.100 release before TuxCare adoption. The CVE affected versions 8.5.0 to 8.5.66; version 8.5.100 includes upstream fixes from Mark Thomas (markt@apache.org) that: (1) process Transfer-Encoding headers from H..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2" } } ], "timestamp": "2026-10-28T23:59:58.436178+00:00", "status_notes": "Vulnerability CVE-2021-41079 affects version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2021-41079" }, "action_statement": "Vulnerability CVE-2021-41079 affects version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-42340 does not affect version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat. Version 8.5.100 is not vulnerable. Summary: Apache Tomcat 8.5.100-tuxcare.6 is NOT vulnerable to CVE-2021-42340. The target version is beyond the vulnerable range (8.5.60 to 8.5.71) and contains the necessary fix. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-42340" }, "impact_statement": "Version 8.5.100 is not vulnerable. Summary: Apache Tomcat 8.5.100-tuxcare.6 is NOT vulnerable to CVE-2021-42340. The target version is beyond the vulnerable range (8.5.60 to 8.5.71) and contains the necessary fix. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2" } } ], "timestamp": "2026-10-30T01:36:00.090546+00:00", "status_notes": "Vulnerability CVE-2021-43980 does not affect version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2021-43980 is NOT present in target Tomcat 8.5.100. The vulnerability involved a concurrency bug where multiple threads could share an Http11Processor instance, causing responses to be delivered to wrong clients. The upstream fix (commit 4a00b0c0890538b9d3107eef8f2e0afadd119beb by Mark Thomas) changed currentProcessor from a simple field to AtomicReference and introduced takeCurrentProcesso...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43980" }, "impact_statement": "not_affected \u2014 CVE-2021-43980 is NOT present in target Tomcat 8.5.100. The vulnerability involved a concurrency bug where multiple threads could share an Http11Processor instance, causing responses to be delivered to wrong clients. The upstream fix (commit 4a00b0c0890538b9d3107eef8f2e0afadd119beb by Mark Thomas) changed currentProcessor from a simple field to AtomicReference and introduced takeCurrentProcesso..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2" } } ], "timestamp": "2026-10-28T21:19:00.657885+00:00", "status_notes": "Vulnerability CVE-2022-23181 affects version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2022-23181" }, "action_statement": "Vulnerability CVE-2022-23181 affects version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2" } } ], "timestamp": "2026-10-28T23:59:58.436178+00:00", "status_notes": "Vulnerability CVE-2022-25762 affects version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2022-25762" }, "action_statement": "Vulnerability CVE-2022-25762 affects version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2" } } ], "timestamp": "2026-10-28T21:16:19.887305+00:00", "status_notes": "Vulnerability CVE-2022-29885 affects version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2022-29885" }, "action_statement": "Vulnerability CVE-2022-29885 affects version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-34305 does not affect version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2022-34305 is not present in Apache Tomcat 8.5.100. The fix for this XSS vulnerability was authored by upstream Apache developer Mark Thomas (markt@apache.org) on June 23, 2022, and was included in the upstream Apache Tomcat 8.5.100 release. TuxCare's 8.5.100 branch inherited this fix from the upstream release. The vulnerable file (webapps/examples/jsp/security/protected/index.jsp) properly...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-34305" }, "impact_statement": "not_affected \u2014 CVE-2022-34305 is not present in Apache Tomcat 8.5.100. The fix for this XSS vulnerability was authored by upstream Apache developer Mark Thomas (markt@apache.org) on June 23, 2022, and was included in the upstream Apache Tomcat 8.5.100 release. TuxCare's 8.5.100 branch inherited this fix from the upstream release. The vulnerable file (webapps/examples/jsp/security/protected/index.jsp) properly..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2" } } ], "timestamp": "2026-10-30T00:47:50.558433+00:00", "status_notes": "Vulnerability CVE-2023-41080 does not affect version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 Apache Tomcat 8.5.100 is NOT vulnerable to CVE-2023-41080 (Open Redirect in FORM authentication). The upstream fix commit 4998ad745b67edeadefe541c94ed029b53933d3b by Mark Thomas is present in HEAD and was included in the upstream release 8.5.93 before TuxCare adoption. The defensive code that strips protocol-relative URL patterns (URLs with multiple leading slashes like //evil.com) is present a...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-41080" }, "impact_statement": "not_affected \u2014 Apache Tomcat 8.5.100 is NOT vulnerable to CVE-2023-41080 (Open Redirect in FORM authentication). The upstream fix commit 4998ad745b67edeadefe541c94ed029b53933d3b by Mark Thomas is present in HEAD and was included in the upstream release 8.5.93 before TuxCare adoption. The defensive code that strips protocol-relative URL patterns (URLs with multiple leading slashes like //evil.com) is present a..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2" } } ], "timestamp": "2026-10-28T18:21:18.934330+00:00", "status_notes": "Vulnerability CVE-2023-42795 does not affect version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 Target Apache Tomcat 8.5.100 is NOT AFFECTED by CVE-2023-42795. The vulnerability affects versions 8.5.0 through 8.5.93 due to incomplete object recycling when exceptions occur during cleanup, potentially causing information leakage between requests. The fix was committed upstream by Mark Thomas (markt@apache.org) on 2023-10-05 in commit 30f8063d7a and shipped in version 8.5.94. Since the targe...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-42795" }, "impact_statement": "not_affected \u2014 Target Apache Tomcat 8.5.100 is NOT AFFECTED by CVE-2023-42795. The vulnerability affects versions 8.5.0 through 8.5.93 due to incomplete object recycling when exceptions occur during cleanup, potentially causing information leakage between requests. The fix was committed upstream by Mark Thomas (markt@apache.org) on 2023-10-05 in commit 30f8063d7a and shipped in version 8.5.94. Since the targe..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-45648 does not affect version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 Target Apache Tomcat 8.5.100 is NOT vulnerable to CVE-2023-45648. The upstream fix for HTTP trailer header validation was already present in the Apache Tomcat 8.5.100 release that TuxCare onboarded. The fix adds validation to reject non-token characters in trailer header names and control characters (except HT) in trailer header values, preventing request smuggling attacks. Commit c83fe47725f7a...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-45648" }, "impact_statement": "not_affected \u2014 Target Apache Tomcat 8.5.100 is NOT vulnerable to CVE-2023-45648. The upstream fix for HTTP trailer header validation was already present in the Apache Tomcat 8.5.100 release that TuxCare onboarded. The fix adds validation to reject non-token characters in trailer header names and control characters (except HT) in trailer header values, preventing request smuggling attacks. Commit c83fe47725f7a..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-54677 does not affect version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat. Version 8.5.100 is not affected by CVE-2024-54677: the security fix is already present in the target branch. Momus prerequisite check: \"Patches already applied: 9ffd23fc27f5d1fc95bf97e5cea175c8968f4533\". No backport needed.", "vulnerability": { "name": "CVE-2024-54677" }, "impact_statement": "Version 8.5.100 is not affected by CVE-2024-54677: the security fix is already present in the target branch. Momus prerequisite check: \"Patches already applied: 9ffd23fc27f5d1fc95bf97e5cea175c8968f4533\". No backport needed." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2" } } ], "timestamp": "2026-10-28T18:12:53.572239+00:00", "status_notes": "Vulnerability CVE-2025-49124 affects version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2025-49124" }, "action_statement": "Vulnerability CVE-2025-49124 affects version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-55752 affects version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat, and is fixed in 8.5.100-tuxcare.5.", "vulnerability": { "name": "CVE-2025-55752" }, "action_statement": "Vulnerability CVE-2025-55752 affects version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat, and is fixed in 8.5.100-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-55754 affects version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat, and is fixed in 8.5.100-tuxcare.5.", "vulnerability": { "name": "CVE-2025-55754" }, "action_statement": "Vulnerability CVE-2025-55754 affects version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat, and is fixed in 8.5.100-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-61795 affects version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat, and is fixed in 8.5.100-tuxcare.5.", "vulnerability": { "name": "CVE-2025-61795" }, "action_statement": "Vulnerability CVE-2025-61795 affects version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat, and is fixed in 8.5.100-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-66614 affects version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat, and is fixed in 8.5.100-tuxcare.8.", "vulnerability": { "name": "CVE-2025-66614" }, "action_statement": "Vulnerability CVE-2025-66614 affects version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat, and is fixed in 8.5.100-tuxcare.8." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25854 affects version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat, and is fixed in 8.5.100-tuxcare.9.", "vulnerability": { "name": "CVE-2026-25854" }, "action_statement": "Vulnerability CVE-2026-25854 affects version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat, and is fixed in 8.5.100-tuxcare.9." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2" } } ], "timestamp": "2026-10-29T07:42:31.773838+00:00", "status_notes": "Vulnerability CVE-2026-29129 affects version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2026-29129" }, "action_statement": "Vulnerability CVE-2026-29129 affects version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2" } } ], "timestamp": "2026-10-28T21:58:36.804623+00:00", "status_notes": "Vulnerability CVE-2026-29145 affects version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2026-29145" }, "action_statement": "Vulnerability CVE-2026-29145 affects version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-29146 affects version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat, and is fixed in 8.5.100-tuxcare.9.", "vulnerability": { "name": "CVE-2026-29146" }, "action_statement": "Vulnerability CVE-2026-29146 affects version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat, and is fixed in 8.5.100-tuxcare.9." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32990 affects version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2026-32990" }, "action_statement": "Vulnerability CVE-2026-32990 affects version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2" } } ], "timestamp": "2026-10-28T18:12:53.572239+00:00", "status_notes": "Vulnerability CVE-2026-34483 affects version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2026-34483" }, "action_statement": "Vulnerability CVE-2026-34483 affects version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34486 affects version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat, and is fixed in 8.5.100-tuxcare.9.", "vulnerability": { "name": "CVE-2026-34486" }, "action_statement": "Vulnerability CVE-2026-34486 affects version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat, and is fixed in 8.5.100-tuxcare.9." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2" } } ], "timestamp": "2026-10-28T18:10:34.135169+00:00", "status_notes": "Vulnerability CVE-2026-34487 affects version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2026-34487" }, "action_statement": "Vulnerability CVE-2026-34487 affects version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41284 affects version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2026-41284" }, "action_statement": "Vulnerability CVE-2026-41284 affects version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41293 affects version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2026-41293" }, "action_statement": "Vulnerability CVE-2026-41293 affects version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42498 affects version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2026-42498" }, "action_statement": "Vulnerability CVE-2026-42498 affects version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-43512 affects version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2026-43512" }, "action_statement": "Vulnerability CVE-2026-43512 affects version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-43513 affects version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2026-43513" }, "action_statement": "Vulnerability CVE-2026-43513 affects version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-43514 affects version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2026-43514" }, "action_statement": "Vulnerability CVE-2026-43514 affects version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-43515 affects version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2026-43515" }, "action_statement": "Vulnerability CVE-2026-43515 affects version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-65182 affects version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2026-65182" }, "action_statement": "Vulnerability CVE-2026-65182 affects version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-65905 affects version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2026-65905" }, "action_statement": "Vulnerability CVE-2026-65905 affects version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.100.tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-68525 affects version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2026-68525" }, "action_statement": "Vulnerability CVE-2026-68525 affects version 8.5.100.tuxcare.2 of org.apache.tomcat:tomcat." } ] }