{
  "@id": "urn:uuid:544801d3-6bb3-463d-a9a2-2bd7b0e026df",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 24,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-30T14:49:00.106665+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability CVE-2008-1947 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2008-1947"
      },
      "action_statement": "Vulnerability CVE-2008-1947 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T14:22:27.284985+00:00",
      "status_notes": "Vulnerability CVE-2013-4590 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2013-4590"
      },
      "action_statement": "Vulnerability CVE-2013-4590 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T14:22:27.284985+00:00",
      "status_notes": "Vulnerability CVE-2015-5174 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2015-5174"
      },
      "action_statement": "Vulnerability CVE-2015-5174 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T14:23:00.531536+00:00",
      "status_notes": "Vulnerability CVE-2015-5346 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2015-5346"
      },
      "action_statement": "Vulnerability CVE-2015-5346 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T14:22:27.284985+00:00",
      "status_notes": "Vulnerability CVE-2016-0706 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2016-0706"
      },
      "action_statement": "Vulnerability CVE-2016-0706 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T02:36:49.908127+00:00",
      "status_notes": "Vulnerability CVE-2016-0762 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2016-0762"
      },
      "action_statement": "Vulnerability CVE-2016-0762 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T14:22:27.284985+00:00",
      "status_notes": "Vulnerability CVE-2016-0763 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2016-0763"
      },
      "action_statement": "Vulnerability CVE-2016-0763 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T02:36:49.908127+00:00",
      "status_notes": "Vulnerability CVE-2016-6794 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2016-6794"
      },
      "action_statement": "Vulnerability CVE-2016-6794 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T02:36:49.908127+00:00",
      "status_notes": "Vulnerability CVE-2016-6796 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2016-6796"
      },
      "action_statement": "Vulnerability CVE-2016-6796 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T02:36:49.908127+00:00",
      "status_notes": "Vulnerability CVE-2016-6797 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2016-6797"
      },
      "action_statement": "Vulnerability CVE-2016-6797 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T14:21:53.066702+00:00",
      "status_notes": "Vulnerability CVE-2016-6817 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2016-6817"
      },
      "action_statement": "Vulnerability CVE-2016-6817 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T14:22:27.284985+00:00",
      "status_notes": "Vulnerability CVE-2016-8747 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2016-8747"
      },
      "action_statement": "Vulnerability CVE-2016-8747 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T02:36:49.908127+00:00",
      "status_notes": "Vulnerability CVE-2017-5647 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2017-5647"
      },
      "action_statement": "Vulnerability CVE-2017-5647 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T14:22:27.284985+00:00",
      "status_notes": "Vulnerability CVE-2017-5650 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2017-5650"
      },
      "action_statement": "Vulnerability CVE-2017-5650 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T02:36:49.908127+00:00",
      "status_notes": "Vulnerability CVE-2017-5664 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2017-5664"
      },
      "action_statement": "Vulnerability CVE-2017-5664 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T02:36:49.908127+00:00",
      "status_notes": "Vulnerability CVE-2017-7674 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2017-7674"
      },
      "action_statement": "Vulnerability CVE-2017-7674 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T14:21:53.066702+00:00",
      "status_notes": "Vulnerability CVE-2017-7675 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2017-7675"
      },
      "action_statement": "Vulnerability CVE-2017-7675 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T23:37:14.382670+00:00",
      "status_notes": "Vulnerability CVE-2019-0221 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2019-0221"
      },
      "action_statement": "Vulnerability CVE-2019-0221 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability CVE-2019-17569 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2019-17569"
      },
      "action_statement": "Vulnerability CVE-2019-17569 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T10:37:05.497711+00:00",
      "status_notes": "Vulnerability CVE-2020-11996 does not affect version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat. CVE-2020-11996 affects Apache Tomcat 9.0.0.M1 to 9.0.35. Target version 9.0.39 (released Oct 2020) already contains the upstream Apache fix from May 2020. The vulnerable closeIdleStreams() method that caused O(n) CPU exhaustion through iterating over large stream ID gaps has been replaced with an efficient subMap() implementation that only iterates over actual existing streams. Vulnerable pattern is not present in the shipped version.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11996"
      },
      "impact_statement": "CVE-2020-11996 affects Apache Tomcat 9.0.0.M1 to 9.0.35. Target version 9.0.39 (released Oct 2020) already contains the upstream Apache fix from May 2020. The vulnerable closeIdleStreams() method that caused O(n) CPU exhaustion through iterating over large stream ID gaps has been replaced with an efficient subMap() implementation that only iterates over actual existing streams. Vulnerable pattern is not present in the shipped version."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T10:37:05.497711+00:00",
      "status_notes": "Vulnerability CVE-2020-13934 does not affect version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat. Target is Apache Tomcat 9.0.39 (tag 6989c4e936, product identity confirmed via ServerInfo.properties + repo layout). CVE-2020-13934 is a memory-exhaustion DoS: on a direct h2c (HTTP/2 cleartext, prior-knowledge) connection, Tomcat upgraded the HTTP/1.1 processor to an HTTP/2 processor WITHOUT releasing/recycling the old Http11Processor, leaking one processor per such connection until OutOfMemoryError. CVE affected range: 9.0.0.M5\u20139.0.36 (fixed 9.0.37). The upstream fix (commit 172977f04a by Mark Thomas <markt@apache.org>, \"Ensure HTTP/1.1 processor is recycled after a direct h2c connection\") IS an ancestor of HEAD, and the current code at java/org/apache/coyote/AbstractProtocol.java exactly matches the post-fix state: line 880 adds `release(processor);` before swapping to the upgrade processor, and line 893 uses `state = SocketState.CLOSED;` (exit loop \u2192 clean-up) instead of the pre-fix `return SocketState.CLOSED;`. The pre-fix vulnerable pattern is absent. Fix author is upstream Apache (apache.org), not TuxCare/CloudLinux, so verdict is not_affected (vendor-fix) with justification code_not_present, not already_fixed.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-13934"
      },
      "impact_statement": "Target is Apache Tomcat 9.0.39 (tag 6989c4e936, product identity confirmed via ServerInfo.properties + repo layout). CVE-2020-13934 is a memory-exhaustion DoS: on a direct h2c (HTTP/2 cleartext, prior-knowledge) connection, Tomcat upgraded the HTTP/1.1 processor to an HTTP/2 processor WITHOUT releasing/recycling the old Http11Processor, leaking one processor per such connection until OutOfMemoryError. CVE affected range: 9.0.0.M5\u20139.0.36 (fixed 9.0.37). The upstream fix (commit 172977f04a by Mark Thomas <markt@apache.org>, \"Ensure HTTP/1.1 processor is recycled after a direct h2c connection\") IS an ancestor of HEAD, and the current code at java/org/apache/coyote/AbstractProtocol.java exactly matches the post-fix state: line 880 adds `release(processor);` before swapping to the upgrade processor, and line 893 uses `state = SocketState.CLOSED;` (exit loop \u2192 clean-up) instead of the pre-fix `return SocketState.CLOSED;`. The pre-fix vulnerable pattern is absent. Fix author is upstream Apache (apache.org), not TuxCare/CloudLinux, so verdict is not_affected (vendor-fix) with justification code_not_present, not already_fixed."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2020-13935 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2020-13935"
      },
      "action_statement": "Vulnerability CVE-2020-13935 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T23:28:44.006786+00:00",
      "status_notes": "Vulnerability CVE-2020-1935 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2020-1935"
      },
      "action_statement": "Vulnerability CVE-2020-1935 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T14:10:00.131690+00:00",
      "status_notes": "Vulnerability CVE-2020-8022 is a false positive for org.apache.tomcat:tomcat 9.0.39-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2020-8022"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T10:37:05.497711+00:00",
      "status_notes": "Vulnerability CVE-2021-30639 does not affect version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat. Apache Tomcat 9.0.39 is not affected by CVE-2021-30639. The vulnerability was introduced in version 9.0.44 when the errorException field was added to Request.java without proper recycling. Version 9.0.39 predates this change and does not contain the errorException field at all, making the vulnerability impossible to manifest.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-30639"
      },
      "impact_statement": "Apache Tomcat 9.0.39 is not affected by CVE-2021-30639. The vulnerability was introduced in version 9.0.44 when the errorException field was added to Request.java without proper recycling. Version 9.0.39 predates this change and does not contain the errorException field at all, making the vulnerability impossible to manifest."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T10:37:05.497711+00:00",
      "status_notes": "Vulnerability CVE-2021-30640 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2021-30640"
      },
      "action_statement": "Vulnerability CVE-2021-30640 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T10:37:50.773574+00:00",
      "status_notes": "Vulnerability CVE-2021-33037 is fixed in version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2021-33037"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T10:37:05.497711+00:00",
      "status_notes": "Vulnerability CVE-2021-41079 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2021-41079"
      },
      "action_statement": "Vulnerability CVE-2021-41079 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T10:37:05.497711+00:00",
      "status_notes": "Vulnerability CVE-2021-42340 does not affect version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat. Tomcat 9.0.39 is not affected by CVE-2021-42340. This CVE describes a memory leak introduced by the fix for bug 63362, which was first applied in version 9.0.40. The vulnerable code (UpgradeInfo/UpgradeGroupInfo classes for collecting HTTP upgrade connection metrics) does not exist in version 9.0.39, making the memory leak pattern unreachable.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-42340"
      },
      "impact_statement": "Tomcat 9.0.39 is not affected by CVE-2021-42340. This CVE describes a memory leak introduced by the fix for bug 63362, which was first applied in version 9.0.40. The vulnerable code (UpgradeInfo/UpgradeGroupInfo classes for collecting HTTP upgrade connection metrics) does not exist in version 9.0.39, making the memory leak pattern unreachable."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T10:37:05.497711+00:00",
      "status_notes": "Vulnerability CVE-2021-43980 is fixed in version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2021-43980"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T10:37:50.773574+00:00",
      "status_notes": "Vulnerability CVE-2022-23181 is fixed in version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2022-23181"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2022-25762 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2022-25762"
      },
      "action_statement": "Vulnerability CVE-2022-25762 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T10:37:50.773574+00:00",
      "status_notes": "Vulnerability CVE-2022-29885 is fixed in version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2022-29885"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T10:37:50.773574+00:00",
      "status_notes": "Vulnerability CVE-2022-34305 is fixed in version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2022-34305"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T10:37:50.773574+00:00",
      "status_notes": "Vulnerability CVE-2023-41080 is fixed in version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2023-41080"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T10:37:50.773574+00:00",
      "status_notes": "Vulnerability CVE-2023-42795 is fixed in version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2023-42795"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T10:37:05.497711+00:00",
      "status_notes": "Vulnerability CVE-2023-45648 is fixed in version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2023-45648"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T10:37:05.497711+00:00",
      "status_notes": "Vulnerability CVE-2024-54677 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2024-54677"
      },
      "action_statement": "Vulnerability CVE-2024-54677 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T10:37:50.773574+00:00",
      "status_notes": "Vulnerability CVE-2025-49124 is fixed in version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2025-49124"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T10:37:50.773574+00:00",
      "status_notes": "Vulnerability CVE-2025-55752 is fixed in version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2025-55752"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T18:11:01.360398+00:00",
      "status_notes": "Vulnerability CVE-2025-55754 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2025-55754"
      },
      "action_statement": "Vulnerability CVE-2025-55754 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T10:37:50.773574+00:00",
      "status_notes": "Vulnerability CVE-2025-61795 is fixed in version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2025-61795"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T10:37:50.773574+00:00",
      "status_notes": "Vulnerability CVE-2025-66614 is fixed in version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2025-66614"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T10:37:05.497711+00:00",
      "status_notes": "Vulnerability CVE-2026-25854 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-25854"
      },
      "action_statement": "Vulnerability CVE-2026-25854 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability CVE-2026-29129 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-29129"
      },
      "action_statement": "Vulnerability CVE-2026-29129 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T21:58:36.804623+00:00",
      "status_notes": "Vulnerability CVE-2026-29145 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-29145"
      },
      "action_statement": "Vulnerability CVE-2026-29145 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T10:37:05.497711+00:00",
      "status_notes": "Vulnerability CVE-2026-29146 is fixed in version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-29146"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T10:37:05.497711+00:00",
      "status_notes": "Vulnerability CVE-2026-32990 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-32990"
      },
      "action_statement": "Vulnerability CVE-2026-32990 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T18:12:53.572239+00:00",
      "status_notes": "Vulnerability CVE-2026-34483 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-34483"
      },
      "action_statement": "Vulnerability CVE-2026-34483 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T14:49:00.106665+00:00",
      "status_notes": "Vulnerability CVE-2026-34486 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-34486"
      },
      "action_statement": "Vulnerability CVE-2026-34486 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T10:37:05.497711+00:00",
      "status_notes": "Vulnerability CVE-2026-34487 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-34487"
      },
      "action_statement": "Vulnerability CVE-2026-34487 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T10:37:05.497711+00:00",
      "status_notes": "Vulnerability CVE-2026-41284 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-41284"
      },
      "action_statement": "Vulnerability CVE-2026-41284 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T10:37:05.497711+00:00",
      "status_notes": "Vulnerability CVE-2026-41293 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-41293"
      },
      "action_statement": "Vulnerability CVE-2026-41293 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T10:37:05.497711+00:00",
      "status_notes": "Vulnerability CVE-2026-42498 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-42498"
      },
      "action_statement": "Vulnerability CVE-2026-42498 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T10:37:05.497711+00:00",
      "status_notes": "Vulnerability CVE-2026-43512 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-43512"
      },
      "action_statement": "Vulnerability CVE-2026-43512 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T10:37:05.497711+00:00",
      "status_notes": "Vulnerability CVE-2026-43513 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-43513"
      },
      "action_statement": "Vulnerability CVE-2026-43513 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T10:37:05.497711+00:00",
      "status_notes": "Vulnerability CVE-2026-43514 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-43514"
      },
      "action_statement": "Vulnerability CVE-2026-43514 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T10:37:05.497711+00:00",
      "status_notes": "Vulnerability CVE-2026-43515 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-43515"
      },
      "action_statement": "Vulnerability CVE-2026-43515 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T10:37:05.497711+00:00",
      "status_notes": "Vulnerability CVE-2026-65182 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-65182"
      },
      "action_statement": "Vulnerability CVE-2026-65182 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T10:37:05.497711+00:00",
      "status_notes": "Vulnerability CVE-2026-65905 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-65905"
      },
      "action_statement": "Vulnerability CVE-2026-65905 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.39-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T10:37:05.497711+00:00",
      "status_notes": "Vulnerability CVE-2026-68525 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-68525"
      },
      "action_statement": "Vulnerability CVE-2026-68525 affects version 9.0.39-tuxcare.2 of org.apache.tomcat:tomcat."
    }
  ]
}