{
  "@id": "urn:uuid:42099159-d711-4962-88bb-331915f36c51",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 33,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-30T14:22:27.284985+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability CVE-2008-1947 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2008-1947"
      },
      "action_statement": "Vulnerability CVE-2008-1947 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T14:21:53.066702+00:00",
      "status_notes": "Vulnerability CVE-2013-4590 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2013-4590"
      },
      "action_statement": "Vulnerability CVE-2013-4590 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T14:21:53.066702+00:00",
      "status_notes": "Vulnerability CVE-2015-5174 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2015-5174"
      },
      "action_statement": "Vulnerability CVE-2015-5174 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T14:22:27.284985+00:00",
      "status_notes": "Vulnerability CVE-2015-5346 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2015-5346"
      },
      "action_statement": "Vulnerability CVE-2015-5346 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T14:21:53.066702+00:00",
      "status_notes": "Vulnerability CVE-2016-0706 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2016-0706"
      },
      "action_statement": "Vulnerability CVE-2016-0706 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T02:36:49.908127+00:00",
      "status_notes": "Vulnerability CVE-2016-0762 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2016-0762"
      },
      "action_statement": "Vulnerability CVE-2016-0762 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T14:22:27.284985+00:00",
      "status_notes": "Vulnerability CVE-2016-0763 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2016-0763"
      },
      "action_statement": "Vulnerability CVE-2016-0763 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T02:36:49.908127+00:00",
      "status_notes": "Vulnerability CVE-2016-6794 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2016-6794"
      },
      "action_statement": "Vulnerability CVE-2016-6794 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T02:36:49.908127+00:00",
      "status_notes": "Vulnerability CVE-2016-6796 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2016-6796"
      },
      "action_statement": "Vulnerability CVE-2016-6796 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T02:36:49.908127+00:00",
      "status_notes": "Vulnerability CVE-2016-6797 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2016-6797"
      },
      "action_statement": "Vulnerability CVE-2016-6797 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T14:21:53.066702+00:00",
      "status_notes": "Vulnerability CVE-2016-6817 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2016-6817"
      },
      "action_statement": "Vulnerability CVE-2016-6817 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T14:22:27.284985+00:00",
      "status_notes": "Vulnerability CVE-2016-8747 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2016-8747"
      },
      "action_statement": "Vulnerability CVE-2016-8747 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T02:36:49.908127+00:00",
      "status_notes": "Vulnerability CVE-2017-5647 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2017-5647"
      },
      "action_statement": "Vulnerability CVE-2017-5647 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T14:22:27.284985+00:00",
      "status_notes": "Vulnerability CVE-2017-5650 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2017-5650"
      },
      "action_statement": "Vulnerability CVE-2017-5650 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T02:36:49.908127+00:00",
      "status_notes": "Vulnerability CVE-2017-5664 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2017-5664"
      },
      "action_statement": "Vulnerability CVE-2017-5664 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T02:36:49.908127+00:00",
      "status_notes": "Vulnerability CVE-2017-7674 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2017-7674"
      },
      "action_statement": "Vulnerability CVE-2017-7674 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T14:21:53.066702+00:00",
      "status_notes": "Vulnerability CVE-2017-7675 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2017-7675"
      },
      "action_statement": "Vulnerability CVE-2017-7675 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T23:37:14.382670+00:00",
      "status_notes": "Vulnerability CVE-2019-0221 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2019-0221"
      },
      "action_statement": "Vulnerability CVE-2019-0221 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability CVE-2019-17569 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2019-17569"
      },
      "action_statement": "Vulnerability CVE-2019-17569 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2020-11996 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat. Version 9.0.87 is not vulnerable. Summary: The target repository is NOT vulnerable to CVE-2020-11996. The vulnerability has been fixed and further optimized. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11996"
      },
      "impact_statement": "Version 9.0.87 is not vulnerable. Summary: The target repository is NOT vulnerable to CVE-2020-11996. The vulnerability has been fixed and further optimized. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2020-13934 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat. CVE-2020-13934 affects Apache Tomcat 9.0.0.M5-9.0.36",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-13934"
      },
      "impact_statement": "CVE-2020-13934 affects Apache Tomcat 9.0.0.M5-9.0.36"
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2020-13935 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2020-13935"
      },
      "action_statement": "Vulnerability CVE-2020-13935 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T23:33:09.807961+00:00",
      "status_notes": "Vulnerability CVE-2020-1935 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2020-1935"
      },
      "action_statement": "Vulnerability CVE-2020-1935 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T14:09:00.258382+00:00",
      "status_notes": "Vulnerability CVE-2020-8022 is a false positive for org.apache.tomcat:tomcat 9.0.87-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2020-8022"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2021-30639 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2021-30639"
      },
      "action_statement": "Vulnerability CVE-2021-30639 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2021-30640 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2021-30640"
      },
      "action_statement": "Vulnerability CVE-2021-30640 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T04:34:00.136956+00:00",
      "status_notes": "Vulnerability CVE-2021-33037 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2021-33037 affects Apache Tomcat 9.0.0.M1 to 9.0.46. The target version (9.0.87) is beyond the affected range and contains all three upstream fixes that were committed on 2021-05-10 and shipped in releases after 9.0.46. The fixes were authored by Mark Thomas (markt@apache.org) and were already present in the upstream Tomcat 9.0.87 release before TuxCare onboarded it. TuxCare backported this...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-33037"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-33037 affects Apache Tomcat 9.0.0.M1 to 9.0.46. The target version (9.0.87) is beyond the affected range and contains all three upstream fixes that were committed on 2021-05-10 and shipped in releases after 9.0.46. The fixes were authored by Mark Thomas (markt@apache.org) and were already present in the upstream Tomcat 9.0.87 release before TuxCare onboarded it. TuxCare backported this..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2021-41079 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2021-41079"
      },
      "action_statement": "Vulnerability CVE-2021-41079 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-42340 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat. Patches already applied: 31d62426645824bdfe076a0c0eafa904d90b4fb9 (already in target via 80f1438ec4 'Close WebConnection', b94ecd1b69 'Make asynchronous error handling more robust.')",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-42340"
      },
      "impact_statement": "Patches already applied: 31d62426645824bdfe076a0c0eafa904d90b4fb9 (already in target via 80f1438ec4 'Close WebConnection', b94ecd1b69 'Make asynchronous error handling more robust.')"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T01:39:00.185420+00:00",
      "status_notes": "Vulnerability CVE-2021-43980 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2021-43980 affects Tomcat 9.0.0-M1 to 9.0.60. The target version 9.0.87 is outside the affected range. The vulnerability involves a concurrency bug where client connections could share Http11Processor instances, causing responses to be delivered to wrong clients. The fix uses atomic operations (AtomicReference and takeCurrentProcessor) to ensure exclusive processor ownership during request ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-43980"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-43980 affects Tomcat 9.0.0-M1 to 9.0.60. The target version 9.0.87 is outside the affected range. The vulnerability involves a concurrency bug where client connections could share Http11Processor instances, causing responses to be delivered to wrong clients. The fix uses atomic operations (AtomicReference and takeCurrentProcessor) to ensure exclusive processor ownership during request ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T21:19:00.657885+00:00",
      "status_notes": "Vulnerability CVE-2022-23181 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2022-23181"
      },
      "action_statement": "Vulnerability CVE-2022-23181 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2022-25762 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2022-25762"
      },
      "action_statement": "Vulnerability CVE-2022-25762 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T21:16:19.887305+00:00",
      "status_notes": "Vulnerability CVE-2022-29885 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2022-29885"
      },
      "action_statement": "Vulnerability CVE-2022-29885 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2022-34305 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2022-34305 affects Apache Tomcat 9.0.30-9.0.64. Target version 9.0.87 is not affected because the upstream Apache vendor already fixed the XSS vulnerability in the Form authentication example. The fix (commit 8b60af90b9 by markt@apache.org, June 23, 2022) adds HTML filtering via util.HTMLFilter.filter() to all user-controlled outputs in webapps/examples/jsp/security/protected/index.jsp. Thi...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-34305"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-34305 affects Apache Tomcat 9.0.30-9.0.64. Target version 9.0.87 is not affected because the upstream Apache vendor already fixed the XSS vulnerability in the Form authentication example. The fix (commit 8b60af90b9 by markt@apache.org, June 23, 2022) adds HTML filtering via util.HTMLFilter.filter() to all user-controlled outputs in webapps/examples/jsp/security/protected/index.jsp. Thi..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T00:49:00.093458+00:00",
      "status_notes": "Vulnerability CVE-2023-41080 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2023-41080 does not affect Apache Tomcat 9.0.87. The open redirect vulnerability via protocol-relative URLs in FORM authentication was fixed by Apache upstream in versions after 9.0.79. The target version (9.0.87) includes the upstream fix from commit 77c0ce2d169e by Mark Thomas, which was present in the Apache 9.0.87 release before TuxCare onboarded it. The defense (stripping leading slash...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-41080"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-41080 does not affect Apache Tomcat 9.0.87. The open redirect vulnerability via protocol-relative URLs in FORM authentication was fixed by Apache upstream in versions after 9.0.79. The target version (9.0.87) includes the upstream fix from commit 77c0ce2d169e by Mark Thomas, which was present in the Apache 9.0.87 release before TuxCare onboarded it. The defense (stripping leading slash..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T18:21:18.934330+00:00",
      "status_notes": "Vulnerability CVE-2023-42795 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2023-42795 is not present in Tomcat 9.0.87. The vulnerability was fixed in upstream Apache Tomcat 9.0.81 (released October 2023), and version 9.0.87 already contains the complete fix. All four protection mechanisms from the upstream patch are present: (1) Request.recycle() wraps part.delete() in try-catch and correctly orders asyncContext nullification, (2) ApplicationHttpRequest.recycle() ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-42795"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-42795 is not present in Tomcat 9.0.87. The vulnerability was fixed in upstream Apache Tomcat 9.0.81 (released October 2023), and version 9.0.87 already contains the complete fix. All four protection mechanisms from the upstream patch are present: (1) Request.recycle() wraps part.delete() in try-catch and correctly orders asyncContext nullification, (2) ApplicationHttpRequest.recycle() ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T19:06:21.253116+00:00",
      "status_notes": "Vulnerability CVE-2023-45648 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2023-45648 is NOT affecting this target. The vulnerability (improper HTTP trailer header parsing leading to request smuggling) was fixed by upstream Apache Tomcat in commit 59583245639 (Mark Thomas, 2023-10-05). This fix was already included in upstream Apache Tomcat 9.0.82+ and was present when TuxCare onboarded version 9.0.87. The target code contains both required validations: (1) traile...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-45648"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-45648 is NOT affecting this target. The vulnerability (improper HTTP trailer header parsing leading to request smuggling) was fixed by upstream Apache Tomcat in commit 59583245639 (Mark Thomas, 2023-10-05). This fix was already included in upstream Apache Tomcat 9.0.82+ and was present when TuxCare onboarded version 9.0.87. The target code contains both required validations: (1) traile..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-54677 does not affect version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat. Patches already applied: 9ffd23fc27f5d1fc95bf97e5cea175c8968f4533 (already in target via 2b6287521b 'Add support for JSON responses to request header example.')",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-54677"
      },
      "impact_statement": "Patches already applied: 9ffd23fc27f5d1fc95bf97e5cea175c8968f4533 (already in target via 2b6287521b 'Add support for JSON responses to request header example.')"
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-49124 is fixed in version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2025-49124"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-55752 is fixed in version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2025-55752"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-55754 is fixed in version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2025-55754"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-61795 is fixed in version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2025-61795"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-66614 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2025-66614"
      },
      "action_statement": "Vulnerability CVE-2025-66614 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-25854 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat, and is fixed in 9.0.87-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2026-25854"
      },
      "action_statement": "Vulnerability CVE-2026-25854 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat, and is fixed in 9.0.87-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability CVE-2026-29129 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-29129"
      },
      "action_statement": "Vulnerability CVE-2026-29129 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-29145 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-29145"
      },
      "action_statement": "Vulnerability CVE-2026-29145 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-29146 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat, and is fixed in 9.0.87-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2026-29146"
      },
      "action_statement": "Vulnerability CVE-2026-29146 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat, and is fixed in 9.0.87-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-32990 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-32990"
      },
      "action_statement": "Vulnerability CVE-2026-32990 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-34483 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat, and is fixed in 9.0.87-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2026-34483"
      },
      "action_statement": "Vulnerability CVE-2026-34483 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat, and is fixed in 9.0.87-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-34486 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat, and is fixed in 9.0.87-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2026-34486"
      },
      "action_statement": "Vulnerability CVE-2026-34486 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat, and is fixed in 9.0.87-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-34487 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-34487"
      },
      "action_statement": "Vulnerability CVE-2026-34487 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41284 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-41284"
      },
      "action_statement": "Vulnerability CVE-2026-41284 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41293 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-41293"
      },
      "action_statement": "Vulnerability CVE-2026-41293 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42498 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-42498"
      },
      "action_statement": "Vulnerability CVE-2026-42498 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-43512 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-43512"
      },
      "action_statement": "Vulnerability CVE-2026-43512 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-43513 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-43513"
      },
      "action_statement": "Vulnerability CVE-2026-43513 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-43514 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-43514"
      },
      "action_statement": "Vulnerability CVE-2026-43514 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-43515 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-43515"
      },
      "action_statement": "Vulnerability CVE-2026-43515 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-65182 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-65182"
      },
      "action_statement": "Vulnerability CVE-2026-65182 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-65905 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-65905"
      },
      "action_statement": "Vulnerability CVE-2026-65905 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.87-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-68525 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-68525"
      },
      "action_statement": "Vulnerability CVE-2026-68525 affects version 9.0.87-tuxcare.3 of org.apache.tomcat:tomcat."
    }
  ]
}