{ "@id": "urn:uuid:aab793bd-d478-4cca-b89a-44403b7eab27", "role": "Document Creator", "author": "https://tuxcare.com", "version": 35, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-10-30T14:22:27.284985+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5" } } ], "timestamp": "2026-10-29T07:42:31.773838+00:00", "status_notes": "Vulnerability CVE-2008-1947 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2008-1947" }, "action_statement": "Vulnerability CVE-2008-1947 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5" } } ], "timestamp": "2026-10-30T14:21:53.066702+00:00", "status_notes": "Vulnerability CVE-2013-4590 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2013-4590" }, "action_statement": "Vulnerability CVE-2013-4590 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5" } } ], "timestamp": "2026-10-30T14:21:53.066702+00:00", "status_notes": "Vulnerability CVE-2015-5174 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2015-5174" }, "action_statement": "Vulnerability CVE-2015-5174 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5" } } ], "timestamp": "2026-10-30T14:22:27.284985+00:00", "status_notes": "Vulnerability CVE-2015-5346 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2015-5346" }, "action_statement": "Vulnerability CVE-2015-5346 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5" } } ], "timestamp": "2026-10-30T14:21:53.066702+00:00", "status_notes": "Vulnerability CVE-2016-0706 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2016-0706" }, "action_statement": "Vulnerability CVE-2016-0706 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5" } } ], "timestamp": "2026-10-29T02:36:49.908127+00:00", "status_notes": "Vulnerability CVE-2016-0762 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2016-0762" }, "action_statement": "Vulnerability CVE-2016-0762 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5" } } ], "timestamp": "2026-10-30T14:22:27.284985+00:00", "status_notes": "Vulnerability CVE-2016-0763 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2016-0763" }, "action_statement": "Vulnerability CVE-2016-0763 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5" } } ], "timestamp": "2026-10-29T02:36:49.908127+00:00", "status_notes": "Vulnerability CVE-2016-6794 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2016-6794" }, "action_statement": "Vulnerability CVE-2016-6794 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5" } } ], "timestamp": "2026-10-29T02:36:49.908127+00:00", "status_notes": "Vulnerability CVE-2016-6796 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2016-6796" }, "action_statement": "Vulnerability CVE-2016-6796 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5" } } ], "timestamp": "2026-10-29T02:36:49.908127+00:00", "status_notes": "Vulnerability CVE-2016-6797 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2016-6797" }, "action_statement": "Vulnerability CVE-2016-6797 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5" } } ], "timestamp": "2026-10-30T14:21:53.066702+00:00", "status_notes": "Vulnerability CVE-2016-6817 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2016-6817" }, "action_statement": "Vulnerability CVE-2016-6817 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5" } } ], "timestamp": "2026-10-30T14:22:27.284985+00:00", "status_notes": "Vulnerability CVE-2016-8747 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2016-8747" }, "action_statement": "Vulnerability CVE-2016-8747 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5" } } ], "timestamp": "2026-10-29T02:36:49.908127+00:00", "status_notes": "Vulnerability CVE-2017-5647 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2017-5647" }, "action_statement": "Vulnerability CVE-2017-5647 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5" } } ], "timestamp": "2026-10-30T14:22:27.284985+00:00", "status_notes": "Vulnerability CVE-2017-5650 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2017-5650" }, "action_statement": "Vulnerability CVE-2017-5650 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5" } } ], "timestamp": "2026-10-29T02:36:49.908127+00:00", "status_notes": "Vulnerability CVE-2017-5664 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2017-5664" }, "action_statement": "Vulnerability CVE-2017-5664 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5" } } ], "timestamp": "2026-10-29T02:36:49.908127+00:00", "status_notes": "Vulnerability CVE-2017-7674 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2017-7674" }, "action_statement": "Vulnerability CVE-2017-7674 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5" } } ], "timestamp": "2026-10-30T14:21:53.066702+00:00", "status_notes": "Vulnerability CVE-2017-7675 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2017-7675" }, "action_statement": "Vulnerability CVE-2017-7675 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5" } } ], "timestamp": "2026-10-28T23:37:14.382670+00:00", "status_notes": "Vulnerability CVE-2019-0221 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2019-0221" }, "action_statement": "Vulnerability CVE-2019-0221 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5" } } ], "timestamp": "2026-10-29T07:42:31.773838+00:00", "status_notes": "Vulnerability CVE-2019-17569 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2019-17569" }, "action_statement": "Vulnerability CVE-2019-17569 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-11996 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2020-11996" }, "action_statement": "Vulnerability CVE-2020-11996 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-13934 does not affect version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat. CVE-2020-13934 is not present in Tomcat 9.0.100. The vulnerability (h2c direct connection causing HTTP/1.1 processor leak leading to pool exhaustion) was fixed in upstream Apache Tomcat 9.0.37 (June 30, 2020) via commit 172977f04a authored by Mark Thomas (markt@apache.org). The fix adds release(processor) before creating the h2c upgrade processor and changes control flow to ensure proper cleanup. Since version 9.0.100 (released Feb 13, 2025) is later than 9.0.37, it inherently includes this upstream fix. The vulnerable code pattern is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-13934" }, "impact_statement": "CVE-2020-13934 is not present in Tomcat 9.0.100. The vulnerability (h2c direct connection causing HTTP/1.1 processor leak leading to pool exhaustion) was fixed in upstream Apache Tomcat 9.0.37 (June 30, 2020) via commit 172977f04a authored by Mark Thomas (markt@apache.org). The fix adds release(processor) before creating the h2c upgrade processor and changes control flow to ensure proper cleanup. Since version 9.0.100 (released Feb 13, 2025) is later than 9.0.37, it inherently includes this upstream fix. The vulnerable code pattern is not present in the target." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5" } } ], "timestamp": "2026-10-28T23:59:58.436178+00:00", "status_notes": "Vulnerability CVE-2020-13935 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2020-13935" }, "action_statement": "Vulnerability CVE-2020-13935 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5" } } ], "timestamp": "2026-10-28T23:33:09.807961+00:00", "status_notes": "Vulnerability CVE-2020-1935 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2020-1935" }, "action_statement": "Vulnerability CVE-2020-1935 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5" } } ], "timestamp": "2026-10-30T14:09:00.258382+00:00", "status_notes": "Vulnerability CVE-2020-8022 is a false positive for org.apache.tomcat:tomcat 9.0.100-tuxcare.5.", "vulnerability": { "name": "CVE-2020-8022" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5" } } ], "timestamp": "2026-10-28T23:59:58.436178+00:00", "status_notes": "Vulnerability CVE-2021-30639 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2021-30639" }, "action_statement": "Vulnerability CVE-2021-30639 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5" } } ], "timestamp": "2026-10-28T23:59:58.436178+00:00", "status_notes": "Vulnerability CVE-2021-30640 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2021-30640" }, "action_statement": "Vulnerability CVE-2021-30640 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5" } } ], "timestamp": "2026-10-30T04:36:00.070178+00:00", "status_notes": "Vulnerability CVE-2021-33037 does not affect version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2021-33037 is not present in Apache Tomcat 9.0.100. All three required defenses are present in the target code: (1) \"identity\" transfer encoding is rejected with 501, (2) chunked encoding is enforced as the final encoding with 400 error if violated, and (3) Transfer-Encoding headers are processed from both HTTP 1.0 and 1.1 clients. These fixes were applied upstream by Apache in May 2021 (co...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-33037" }, "impact_statement": "not_affected \u2014 CVE-2021-33037 is not present in Apache Tomcat 9.0.100. All three required defenses are present in the target code: (1) \"identity\" transfer encoding is rejected with 501, (2) chunked encoding is enforced as the final encoding with 400 error if violated, and (3) Transfer-Encoding headers are processed from both HTTP 1.0 and 1.1 clients. These fixes were applied upstream by Apache in May 2021 (co..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5" } } ], "timestamp": "2026-10-28T23:59:58.436178+00:00", "status_notes": "Vulnerability CVE-2021-41079 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2021-41079" }, "action_statement": "Vulnerability CVE-2021-41079 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-42340 does not affect version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat. already_fixed \u2014 CVE-2021-42340 is NOT present in this repository. The fix for the WebSocket connection memory leak has already been applied. The target repository (Apache Tomcat 9.0.100) contains the complete upstream fix from commit 80f1438ec45 (2021-09-27) which properly manages WebConnection references to prevent memory leaks when WebSocket connections are closed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-42340" }, "impact_statement": "already_fixed \u2014 CVE-2021-42340 is NOT present in this repository. The fix for the WebSocket connection memory leak has already been applied. The target repository (Apache Tomcat 9.0.100) contains the complete upstream fix from commit 80f1438ec45 (2021-09-27) which properly manages WebConnection references to prevent memory leaks when WebSocket connections are closed." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5" } } ], "timestamp": "2026-10-30T01:38:00.183284+00:00", "status_notes": "Vulnerability CVE-2021-43980 does not affect version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2021-43980 affects Tomcat 9.0.0-M1 to 9.0.60 due to a concurrency bug where multiple threads could share an Http11Processor instance, causing responses to be delivered to wrong clients. The target version 9.0.100 already contains the upstream fix (commit 170e0f792b by Mark Thomas, March 2022) which was shipped in the Apache Tomcat 9.0.61+ release. The fix uses AtomicReference for thread-saf...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43980" }, "impact_statement": "not_affected \u2014 CVE-2021-43980 affects Tomcat 9.0.0-M1 to 9.0.60 due to a concurrency bug where multiple threads could share an Http11Processor instance, causing responses to be delivered to wrong clients. The target version 9.0.100 already contains the upstream fix (commit 170e0f792b by Mark Thomas, March 2022) which was shipped in the Apache Tomcat 9.0.61+ release. The fix uses AtomicReference for thread-saf..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5" } } ], "timestamp": "2026-10-28T21:19:00.657885+00:00", "status_notes": "Vulnerability CVE-2022-23181 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2022-23181" }, "action_statement": "Vulnerability CVE-2022-23181 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5" } } ], "timestamp": "2026-10-28T23:59:58.436178+00:00", "status_notes": "Vulnerability CVE-2022-25762 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2022-25762" }, "action_statement": "Vulnerability CVE-2022-25762 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5" } } ], "timestamp": "2026-10-28T21:16:19.887305+00:00", "status_notes": "Vulnerability CVE-2022-29885 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2022-29885" }, "action_statement": "Vulnerability CVE-2022-29885 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-34305 does not affect version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2022-34305 XSS vulnerability is not present in Tomcat 9.0.100. The upstream Apache fix (commit 8b60af90b9) was already included in version 9.0.65, well before the 9.0.100 release. All user-controlled data in the Form authentication example (session attributes at lines 178-179, principal attributes at lines 112-114) are properly filtered with util.HTMLFilter.filter() which encodes HTML speci...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-34305" }, "impact_statement": "not_affected \u2014 CVE-2022-34305 XSS vulnerability is not present in Tomcat 9.0.100. The upstream Apache fix (commit 8b60af90b9) was already included in version 9.0.65, well before the 9.0.100 release. All user-controlled data in the Form authentication example (session attributes at lines 178-179, principal attributes at lines 112-114) are properly filtered with util.HTMLFilter.filter() which encodes HTML speci..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5" } } ], "timestamp": "2026-10-30T00:50:04.588656+00:00", "status_notes": "Vulnerability CVE-2023-41080 does not affect version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2023-41080 (Open Redirect in FORM authentication) does NOT affect Tomcat 9.0.100. The upstream fix by Mark Thomas (markt@apache.org, commit 77c0ce2d1..., August 22, 2023) was already present in Apache Tomcat 9.0.100 before TuxCare onboarded it. The fix strips extra leading slashes from redirect URLs in FormAuthenticator.savedRequestURL() (lines 766-769), preventing protocol-relative URL red...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-41080" }, "impact_statement": "not_affected \u2014 CVE-2023-41080 (Open Redirect in FORM authentication) does NOT affect Tomcat 9.0.100. The upstream fix by Mark Thomas (markt@apache.org, commit 77c0ce2d1..., August 22, 2023) was already present in Apache Tomcat 9.0.100 before TuxCare onboarded it. The fix strips extra leading slashes from redirect URLs in FormAuthenticator.savedRequestURL() (lines 766-769), preventing protocol-relative URL red..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5" } } ], "timestamp": "2026-10-28T18:23:53.811682+00:00", "status_notes": "Vulnerability CVE-2023-42795 does not affect version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2023-42795 fix was already present in upstream Apache Tomcat 9.0.100 release. The vulnerability affects versions 9.0.0-M1 through 9.0.80; the fix shipped in 9.0.81 onwards per upstream. Target version 9.0.100 already contains commit 44d05d75d6 by markt@apache.org which wraps all vulnerable recycle() cleanup operations in try-catch blocks to prevent incomplete cleanup when errors occur. No T...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-42795" }, "impact_statement": "not_affected \u2014 CVE-2023-42795 fix was already present in upstream Apache Tomcat 9.0.100 release. The vulnerability affects versions 9.0.0-M1 through 9.0.80; the fix shipped in 9.0.81 onwards per upstream. Target version 9.0.100 already contains commit 44d05d75d6 by markt@apache.org which wraps all vulnerable recycle() cleanup operations in try-catch blocks to prevent incomplete cleanup when errors occur. No T..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-45648 does not affect version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2023-45648 is not present in Tomcat 9.0.100. The vulnerability (improper parsing of HTTP trailer headers in chunked transfer encoding requests, enabling request smuggling) was fixed in upstream Apache Tomcat through architectural refactoring that introduced the HttpHeaderParser class with proper validation of trailer header names and values. This upstream fix was already present in the 9.0....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-45648" }, "impact_statement": "not_affected \u2014 CVE-2023-45648 is not present in Tomcat 9.0.100. The vulnerability (improper parsing of HTTP trailer headers in chunked transfer encoding requests, enabling request smuggling) was fixed in upstream Apache Tomcat through architectural refactoring that introduced the HttpHeaderParser class with proper validation of trailer header names and values. This upstream fix was already present in the 9.0...." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-54677 does not affect version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2024-54677 affects Apache Tomcat 9.0.0.M1 through 9.0.97 via uncontrolled resource consumption in the examples web application. The target (version 9.0.100) is NOT AFFECTED because all upstream fixes for this CVE were already present in the Apache Tomcat 9.0.100 release that TuxCare onboarded. The vulnerable pattern (unlimited session attribute storage, arbitrary shopping cart items, vulner...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-54677" }, "impact_statement": "not_affected \u2014 CVE-2024-54677 affects Apache Tomcat 9.0.0.M1 through 9.0.97 via uncontrolled resource consumption in the examples web application. The target (version 9.0.100) is NOT AFFECTED because all upstream fixes for this CVE were already present in the Apache Tomcat 9.0.100 release that TuxCare onboarded. The vulnerable pattern (unlimited session attribute storage, arbitrary shopping cart items, vulner..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-49124 is fixed in version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2025-49124" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-55752 is fixed in version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2025-55752" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-55754 is fixed in version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2025-55754" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-61795 is fixed in version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2025-61795" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-66614 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat, and is fixed in 9.0.100-tuxcare.6.", "vulnerability": { "name": "CVE-2025-66614" }, "action_statement": "Vulnerability CVE-2025-66614 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat, and is fixed in 9.0.100-tuxcare.6." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25854 is fixed in version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2026-25854" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5" } } ], "timestamp": "2026-10-29T07:42:31.773838+00:00", "status_notes": "Vulnerability CVE-2026-29129 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2026-29129" }, "action_statement": "Vulnerability CVE-2026-29129 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5" } } ], "timestamp": "2026-10-25T20:17:00.165429+00:00", "status_notes": "Vulnerability CVE-2026-29145 does not affect version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat. Tomcat 9.0.100 is not affected by CVE-2026-29145. The flaw is that the FFM OpenSSL verify callback accepts non-SUCCESSFUL OCSP responses (e.g. TRY_LATER). On 9.0.100 the check in OpenSSLEngine still rejects them (UNKNOWN status with errnum <= 0 fails the handshake). The lenient check that caused the flaw (upstream 4881026c62, first in 9.0.111) is not present. The upstream fix d1406df5ae only re-codes these responses as X509_V_ERR_UNABLE_TO_GET_CRL for the ocspSoftFail switch added in 9.0.116, which 9.0.100 does not have. Applied to 9.0.100, that patch would turn the reject into an accept, as reproduced in docker with a TRY_LATER OCSP responder. The same backport was reverted on 10.1.42 (!331). No code change is needed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-29145" }, "impact_statement": "Tomcat 9.0.100 is not affected by CVE-2026-29145. The flaw is that the FFM OpenSSL verify callback accepts non-SUCCESSFUL OCSP responses (e.g. TRY_LATER). On 9.0.100 the check in OpenSSLEngine still rejects them (UNKNOWN status with errnum <= 0 fails the handshake). The lenient check that caused the flaw (upstream 4881026c62, first in 9.0.111) is not present. The upstream fix d1406df5ae only re-codes these responses as X509_V_ERR_UNABLE_TO_GET_CRL for the ocspSoftFail switch added in 9.0.116, which 9.0.100 does not have. Applied to 9.0.100, that patch would turn the reject into an accept, as reproduced in docker with a TRY_LATER OCSP responder. The same backport was reverted on 10.1.42 (!331). No code change is needed." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-29146 is fixed in version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2026-29146" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32990 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2026-32990" }, "action_statement": "Vulnerability CVE-2026-32990 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34483 is fixed in version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2026-34483" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34486 is fixed in version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2026-34486" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34487 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2026-34487" }, "action_statement": "Vulnerability CVE-2026-34487 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41284 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2026-41284" }, "action_statement": "Vulnerability CVE-2026-41284 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41293 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2026-41293" }, "action_statement": "Vulnerability CVE-2026-41293 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42498 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2026-42498" }, "action_statement": "Vulnerability CVE-2026-42498 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-43512 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2026-43512" }, "action_statement": "Vulnerability CVE-2026-43512 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-43513 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2026-43513" }, "action_statement": "Vulnerability CVE-2026-43513 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-43514 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2026-43514" }, "action_statement": "Vulnerability CVE-2026-43514 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-43515 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2026-43515" }, "action_statement": "Vulnerability CVE-2026-43515 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-65182 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2026-65182" }, "action_statement": "Vulnerability CVE-2026-65182 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-65905 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2026-65905" }, "action_statement": "Vulnerability CVE-2026-65905 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.100-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-68525 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2026-68525" }, "action_statement": "Vulnerability CVE-2026-68525 affects version 9.0.100-tuxcare.5 of org.apache.tomcat:tomcat." } ] }