{ "@id": "urn:uuid:18ec3341-f0b0-478d-9410-b7e6c63038ea", "role": "Document Creator", "author": "https://tuxcare.com", "version": 37, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-10-30T14:23:00.531536+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5" } } ], "timestamp": "2026-10-29T07:42:31.773838+00:00", "status_notes": "Vulnerability CVE-2008-1947 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2008-1947" }, "action_statement": "Vulnerability CVE-2008-1947 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5" } } ], "timestamp": "2026-10-30T14:22:27.284985+00:00", "status_notes": "Vulnerability CVE-2013-4590 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2013-4590" }, "action_statement": "Vulnerability CVE-2013-4590 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5" } } ], "timestamp": "2026-10-30T14:22:27.284985+00:00", "status_notes": "Vulnerability CVE-2015-5174 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2015-5174" }, "action_statement": "Vulnerability CVE-2015-5174 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5" } } ], "timestamp": "2026-10-30T14:23:00.531536+00:00", "status_notes": "Vulnerability CVE-2015-5346 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2015-5346" }, "action_statement": "Vulnerability CVE-2015-5346 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5" } } ], "timestamp": "2026-10-30T14:22:27.284985+00:00", "status_notes": "Vulnerability CVE-2016-0706 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2016-0706" }, "action_statement": "Vulnerability CVE-2016-0706 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5" } } ], "timestamp": "2026-10-29T02:36:49.908127+00:00", "status_notes": "Vulnerability CVE-2016-0762 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2016-0762" }, "action_statement": "Vulnerability CVE-2016-0762 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5" } } ], "timestamp": "2026-10-30T14:22:27.284985+00:00", "status_notes": "Vulnerability CVE-2016-0763 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2016-0763" }, "action_statement": "Vulnerability CVE-2016-0763 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5" } } ], "timestamp": "2026-10-29T02:36:49.908127+00:00", "status_notes": "Vulnerability CVE-2016-6794 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2016-6794" }, "action_statement": "Vulnerability CVE-2016-6794 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5" } } ], "timestamp": "2026-10-29T02:36:49.908127+00:00", "status_notes": "Vulnerability CVE-2016-6796 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2016-6796" }, "action_statement": "Vulnerability CVE-2016-6796 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5" } } ], "timestamp": "2026-10-29T02:36:49.908127+00:00", "status_notes": "Vulnerability CVE-2016-6797 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2016-6797" }, "action_statement": "Vulnerability CVE-2016-6797 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5" } } ], "timestamp": "2026-10-30T14:21:53.066702+00:00", "status_notes": "Vulnerability CVE-2016-6817 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2016-6817" }, "action_statement": "Vulnerability CVE-2016-6817 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5" } } ], "timestamp": "2026-10-30T14:22:27.284985+00:00", "status_notes": "Vulnerability CVE-2016-8747 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2016-8747" }, "action_statement": "Vulnerability CVE-2016-8747 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5" } } ], "timestamp": "2026-10-29T02:36:49.908127+00:00", "status_notes": "Vulnerability CVE-2017-5647 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2017-5647" }, "action_statement": "Vulnerability CVE-2017-5647 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5" } } ], "timestamp": "2026-10-30T14:22:27.284985+00:00", "status_notes": "Vulnerability CVE-2017-5650 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2017-5650" }, "action_statement": "Vulnerability CVE-2017-5650 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5" } } ], "timestamp": "2026-10-29T02:36:49.908127+00:00", "status_notes": "Vulnerability CVE-2017-5664 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2017-5664" }, "action_statement": "Vulnerability CVE-2017-5664 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5" } } ], "timestamp": "2026-10-29T02:36:49.908127+00:00", "status_notes": "Vulnerability CVE-2017-7674 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2017-7674" }, "action_statement": "Vulnerability CVE-2017-7674 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5" } } ], "timestamp": "2026-10-30T14:21:53.066702+00:00", "status_notes": "Vulnerability CVE-2017-7675 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2017-7675" }, "action_statement": "Vulnerability CVE-2017-7675 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5" } } ], "timestamp": "2026-10-28T23:37:14.382670+00:00", "status_notes": "Vulnerability CVE-2019-0221 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2019-0221" }, "action_statement": "Vulnerability CVE-2019-0221 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5" } } ], "timestamp": "2026-10-29T07:42:31.773838+00:00", "status_notes": "Vulnerability CVE-2019-17569 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2019-17569" }, "action_statement": "Vulnerability CVE-2019-17569 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-11996 does not affect version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat. Apache Tomcat 9.0.83 is not affected by CVE-2020-11996. The vulnerability (high CPU usage from inefficient iteration over large HTTP/2 stream ID gaps) was fixed upstream in commit 9a0231683a, Fix BZ 64467 Improve performance of closing idle streams, which shipped in Tomcat 9.0.36 in June 2020. The target version 9.0.83 naturally includes this upstream vendor fix. The vulnerable sequential iteration through stream IDs has been replaced with an optimized ConcurrentNavigableMap.subMap() approach in Http2UpgradeHandler.closeIdleStreams that only iterates over actually-existing streams, preventing CPU exhaustion attacks. The CVE affected versions 9.0.0.M1 to 9.0.35; version 9.0.83 is well beyond the affected range.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11996" }, "impact_statement": "Apache Tomcat 9.0.83 is not affected by CVE-2020-11996. The vulnerability (high CPU usage from inefficient iteration over large HTTP/2 stream ID gaps) was fixed upstream in commit 9a0231683a, Fix BZ 64467 Improve performance of closing idle streams, which shipped in Tomcat 9.0.36 in June 2020. The target version 9.0.83 naturally includes this upstream vendor fix. The vulnerable sequential iteration through stream IDs has been replaced with an optimized ConcurrentNavigableMap.subMap() approach in Http2UpgradeHandler.closeIdleStreams that only iterates over actually-existing streams, preventing CPU exhaustion attacks. The CVE affected versions 9.0.0.M1 to 9.0.35; version 9.0.83 is well beyond the affected range." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-13934 does not affect version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat. CVE-2020-13934 is not present in Tomcat 9.0.83-tuxcare.5. The vulnerability affects Tomcat 9.0.0.M5 to 9.0.36 where h2c direct connections did not release the HTTP/1.1 processor after upgrading to HTTP/2, causing memory exhaustion. The upstream Apache fix (commit 172977f0 by Mark Thomas, released in 9.0.37) that adds release(processor) before creating the upgrade processor is already present in the target at AbstractProtocol.java lines 945-946. Since version 9.0.83 is well after the affected range and inherits the vendor fix from upstream, the target is not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-13934" }, "impact_statement": "CVE-2020-13934 is not present in Tomcat 9.0.83-tuxcare.5. The vulnerability affects Tomcat 9.0.0.M5 to 9.0.36 where h2c direct connections did not release the HTTP/1.1 processor after upgrading to HTTP/2, causing memory exhaustion. The upstream Apache fix (commit 172977f0 by Mark Thomas, released in 9.0.37) that adds release(processor) before creating the upgrade processor is already present in the target at AbstractProtocol.java lines 945-946. Since version 9.0.83 is well after the affected range and inherits the vendor fix from upstream, the target is not affected." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5" } } ], "timestamp": "2026-10-28T23:59:58.436178+00:00", "status_notes": "Vulnerability CVE-2020-13935 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2020-13935" }, "action_statement": "Vulnerability CVE-2020-13935 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5" } } ], "timestamp": "2026-10-28T23:33:09.807961+00:00", "status_notes": "Vulnerability CVE-2020-1935 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2020-1935" }, "action_statement": "Vulnerability CVE-2020-1935 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5" } } ], "timestamp": "2026-10-30T14:10:00.131690+00:00", "status_notes": "Vulnerability CVE-2020-8022 is a false positive for org.apache.tomcat:tomcat 9.0.83-tuxcare.5.", "vulnerability": { "name": "CVE-2020-8022" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5" } } ], "timestamp": "2026-10-28T23:59:58.436178+00:00", "status_notes": "Vulnerability CVE-2021-30639 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2021-30639" }, "action_statement": "Vulnerability CVE-2021-30639 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5" } } ], "timestamp": "2026-10-28T23:59:58.436178+00:00", "status_notes": "Vulnerability CVE-2021-30640 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2021-30640" }, "action_statement": "Vulnerability CVE-2021-30640 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5" } } ], "timestamp": "2026-10-30T04:42:00.144357+00:00", "status_notes": "Vulnerability CVE-2021-33037 does not affect version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat. not_affected \u2014 Apache Tomcat 9.0.83 is not affected by CVE-2021-33037. All three required fixes for the HTTP request smuggling vulnerability are present in the target code. The CVE affects versions 9.0.0.M1 to 9.0.46; the fixes were introduced in upstream Apache Tomcat 9.0.47 (commit a2c3dc4c96 by Mark Thomas), and the target version 9.0.83 shipped with these fixes already included in the upstream release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-33037" }, "impact_statement": "not_affected \u2014 Apache Tomcat 9.0.83 is not affected by CVE-2021-33037. All three required fixes for the HTTP request smuggling vulnerability are present in the target code. The CVE affects versions 9.0.0.M1 to 9.0.46; the fixes were introduced in upstream Apache Tomcat 9.0.47 (commit a2c3dc4c96 by Mark Thomas), and the target version 9.0.83 shipped with these fixes already included in the upstream release." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5" } } ], "timestamp": "2026-10-28T23:59:58.436178+00:00", "status_notes": "Vulnerability CVE-2021-41079 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2021-41079" }, "action_statement": "Vulnerability CVE-2021-41079 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-42340 does not affect version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat. The target Apache Tomcat 9.0.83-tuxcare.5 is NOT vulnerable to CVE-2021-42340. The memory leak vulnerability affecting WebSocket connections was fixed by upstream Apache in commit 80f1438ec45 (2021-09-27) and is already present in the base Apache Tomcat 9.0.83 release (2023-11-09) that TuxCare's version is built upon. The vulnerable code pattern (missing WebConnection storage and cleanup) does not exist in the target. The fix properly stores the WebConnection reference during init() and closes/nulls it in destroy(), preventing the memory leak.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-42340" }, "impact_statement": "The target Apache Tomcat 9.0.83-tuxcare.5 is NOT vulnerable to CVE-2021-42340. The memory leak vulnerability affecting WebSocket connections was fixed by upstream Apache in commit 80f1438ec45 (2021-09-27) and is already present in the base Apache Tomcat 9.0.83 release (2023-11-09) that TuxCare's version is built upon. The vulnerable code pattern (missing WebConnection storage and cleanup) does not exist in the target. The fix properly stores the WebConnection reference during init() and closes/nulls it in destroy(), preventing the memory leak." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5" } } ], "timestamp": "2026-10-30T01:45:09.863951+00:00", "status_notes": "Vulnerability CVE-2021-43980 does not affect version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat. not_affected \u2014 The target Tomcat 9.0.83 is not affected by CVE-2021-43980. The vulnerability was fixed in upstream Apache Tomcat 9.0.61 (commit 170e0f792b by Mark Thomas), which is already included in the 9.0.83 codebase. The fix uses AtomicReference and atomic getAndSet operations to ensure exclusive processor ownership, preventing concurrent threads from sharing Http11Processor instances that would cause re...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43980" }, "impact_statement": "not_affected \u2014 The target Tomcat 9.0.83 is not affected by CVE-2021-43980. The vulnerability was fixed in upstream Apache Tomcat 9.0.61 (commit 170e0f792b by Mark Thomas), which is already included in the 9.0.83 codebase. The fix uses AtomicReference and atomic getAndSet operations to ensure exclusive processor ownership, preventing concurrent threads from sharing Http11Processor instances that would cause re..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5" } } ], "timestamp": "2026-10-28T21:20:09.538096+00:00", "status_notes": "Vulnerability CVE-2022-23181 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2022-23181" }, "action_statement": "Vulnerability CVE-2022-23181 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5" } } ], "timestamp": "2026-10-28T23:59:58.436178+00:00", "status_notes": "Vulnerability CVE-2022-25762 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2022-25762" }, "action_statement": "Vulnerability CVE-2022-25762 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5" } } ], "timestamp": "2026-10-28T21:16:19.887305+00:00", "status_notes": "Vulnerability CVE-2022-29885 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2022-29885" }, "action_statement": "Vulnerability CVE-2022-29885 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-34305 does not affect version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat. not_affected \u2014 fixed upstream before 9.0.83: CVE-2022-34305 fix 8b60af90b999 by markt@apache.org (2022-06-23) is an ancestor of tuxcare-current/9.0.83 (inside upstream tag 9.0.83); no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commits VC credited are backports for other CVEs on the same branch. Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-34305" }, "impact_statement": "not_affected \u2014 fixed upstream before 9.0.83: CVE-2022-34305 fix 8b60af90b999 by markt@apache.org (2022-06-23) is an ancestor of tuxcare-current/9.0.83 (inside upstream tag 9.0.83); no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commits VC credited are backports for other CVEs on the same branch. Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5" } } ], "timestamp": "2026-10-30T00:54:00.090269+00:00", "status_notes": "Vulnerability CVE-2023-41080 does not affect version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2023-41080 (open redirect in FORM authentication) is NOT present in the target. The vulnerability was already fixed in the upstream Apache Tomcat 9.0.83 release before TuxCare onboarded this version. The fix commit 77c0ce2d16 by Mark Thomas (markt@apache.org) was applied on 2023-08-22, before the 9.0.83 release tag on 2023-11-09. The fix is present at FormAuthenticator.java:761-764, which s...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-41080" }, "impact_statement": "not_affected \u2014 CVE-2023-41080 (open redirect in FORM authentication) is NOT present in the target. The vulnerability was already fixed in the upstream Apache Tomcat 9.0.83 release before TuxCare onboarded this version. The fix commit 77c0ce2d16 by Mark Thomas (markt@apache.org) was applied on 2023-08-22, before the 9.0.83 release tag on 2023-11-09. The fix is present at FormAuthenticator.java:761-764, which s..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5" } } ], "timestamp": "2026-10-28T18:26:26.333782+00:00", "status_notes": "Vulnerability CVE-2023-42795 does not affect version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2023-42795 fix is already present in the target repository. The vulnerability addresses incomplete cleanup during object recycling that could leak information between requests. The fix, authored by Mark Thomas (markt@apache.org) in upstream commit 44d05d75d696ca10ce251e4e370511e38f20ae75, was included in Apache Tomcat 9.0.81 and is present in the target's base version 9.0.83. All four affec...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-42795" }, "impact_statement": "not_affected \u2014 CVE-2023-42795 fix is already present in the target repository. The vulnerability addresses incomplete cleanup during object recycling that could leak information between requests. The fix, authored by Mark Thomas (markt@apache.org) in upstream commit 44d05d75d696ca10ce251e4e370511e38f20ae75, was included in Apache Tomcat 9.0.81 and is present in the target's base version 9.0.83. All four affec..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5" } } ], "timestamp": "2026-10-28T19:10:05.488784+00:00", "status_notes": "Vulnerability CVE-2023-45648 does not affect version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat. not_affected \u2014 The target Apache Tomcat 9.0.83-tuxcare.6 is NOT AFFECTED by CVE-2023-45648. The vulnerability involves improper parsing of HTTP trailer headers that could enable request smuggling. The upstream fix (commit 59583245639d8c42ae0009f4a4a70464d3ea70a0 by Mark Thomas) adds two critical validations: (1) trailer header names must be valid HTTP tokens using HttpParser.isToken(), and (2) trailer header ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-45648" }, "impact_statement": "not_affected \u2014 The target Apache Tomcat 9.0.83-tuxcare.6 is NOT AFFECTED by CVE-2023-45648. The vulnerability involves improper parsing of HTTP trailer headers that could enable request smuggling. The upstream fix (commit 59583245639d8c42ae0009f4a4a70464d3ea70a0 by Mark Thomas) adds two critical validations: (1) trailer header names must be valid HTTP tokens using HttpParser.isToken(), and (2) trailer header ..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-54677 is fixed in version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2024-54677" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-49124 is fixed in version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2025-49124" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-55752 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2025-55752" }, "action_statement": "Vulnerability CVE-2025-55752 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-55754 is fixed in version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2025-55754" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-61795 is fixed in version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2025-61795" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-66614 is fixed in version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2025-66614" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5" } } ], "timestamp": "2026-10-22T14:18:08.466710+00:00", "status_notes": "Vulnerability CVE-2026-25854 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat, and is fixed in 9.0.83-tuxcare.6.", "vulnerability": { "name": "CVE-2026-25854" }, "action_statement": "Vulnerability CVE-2026-25854 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat, and is fixed in 9.0.83-tuxcare.6." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5" } } ], "timestamp": "2026-10-29T07:42:31.773838+00:00", "status_notes": "Vulnerability CVE-2026-29129 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2026-29129" }, "action_statement": "Vulnerability CVE-2026-29129 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5" } } ], "timestamp": "2026-10-17T09:03:00.158583+00:00", "status_notes": "Vulnerability CVE-2026-29145 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2026-29145" }, "action_statement": "Vulnerability CVE-2026-29145 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-29146 is fixed in version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2026-29146" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32990 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2026-32990" }, "action_statement": "Vulnerability CVE-2026-32990 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34483 is fixed in version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2026-34483" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34486 is fixed in version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2026-34486" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34487 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2026-34487" }, "action_statement": "Vulnerability CVE-2026-34487 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41284 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2026-41284" }, "action_statement": "Vulnerability CVE-2026-41284 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41293 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2026-41293" }, "action_statement": "Vulnerability CVE-2026-41293 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42498 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2026-42498" }, "action_statement": "Vulnerability CVE-2026-42498 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-43512 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2026-43512" }, "action_statement": "Vulnerability CVE-2026-43512 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-43513 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2026-43513" }, "action_statement": "Vulnerability CVE-2026-43513 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-43514 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2026-43514" }, "action_statement": "Vulnerability CVE-2026-43514 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-43515 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2026-43515" }, "action_statement": "Vulnerability CVE-2026-43515 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-65182 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2026-65182" }, "action_statement": "Vulnerability CVE-2026-65182 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-65905 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2026-65905" }, "action_statement": "Vulnerability CVE-2026-65905 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5", "identifiers": { "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.83-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-68525 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat.", "vulnerability": { "name": "CVE-2026-68525" }, "action_statement": "Vulnerability CVE-2026-68525 affects version 9.0.83-tuxcare.5 of org.apache.tomcat:tomcat." } ] }