{
  "@id": "urn:uuid:19ff8183-5a8e-449a-bf2e-8112279679d2",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 35,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-30T14:22:27.284985+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability CVE-2008-1947 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2008-1947"
      },
      "action_statement": "Vulnerability CVE-2008-1947 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-30T14:21:53.066702+00:00",
      "status_notes": "Vulnerability CVE-2013-4590 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2013-4590"
      },
      "action_statement": "Vulnerability CVE-2013-4590 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-30T14:21:53.066702+00:00",
      "status_notes": "Vulnerability CVE-2015-5174 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2015-5174"
      },
      "action_statement": "Vulnerability CVE-2015-5174 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-30T14:22:27.284985+00:00",
      "status_notes": "Vulnerability CVE-2015-5346 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2015-5346"
      },
      "action_statement": "Vulnerability CVE-2015-5346 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-30T14:21:53.066702+00:00",
      "status_notes": "Vulnerability CVE-2016-0706 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2016-0706"
      },
      "action_statement": "Vulnerability CVE-2016-0706 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-29T02:36:49.908127+00:00",
      "status_notes": "Vulnerability CVE-2016-0762 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2016-0762"
      },
      "action_statement": "Vulnerability CVE-2016-0762 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-30T14:22:27.284985+00:00",
      "status_notes": "Vulnerability CVE-2016-0763 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2016-0763"
      },
      "action_statement": "Vulnerability CVE-2016-0763 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-29T02:36:49.908127+00:00",
      "status_notes": "Vulnerability CVE-2016-6794 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2016-6794"
      },
      "action_statement": "Vulnerability CVE-2016-6794 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-29T02:36:49.908127+00:00",
      "status_notes": "Vulnerability CVE-2016-6796 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2016-6796"
      },
      "action_statement": "Vulnerability CVE-2016-6796 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-29T02:36:49.908127+00:00",
      "status_notes": "Vulnerability CVE-2016-6797 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2016-6797"
      },
      "action_statement": "Vulnerability CVE-2016-6797 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-30T14:21:53.066702+00:00",
      "status_notes": "Vulnerability CVE-2016-6817 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2016-6817"
      },
      "action_statement": "Vulnerability CVE-2016-6817 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-30T14:22:27.284985+00:00",
      "status_notes": "Vulnerability CVE-2016-8747 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2016-8747"
      },
      "action_statement": "Vulnerability CVE-2016-8747 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-29T02:36:49.908127+00:00",
      "status_notes": "Vulnerability CVE-2017-5647 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2017-5647"
      },
      "action_statement": "Vulnerability CVE-2017-5647 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-30T14:22:27.284985+00:00",
      "status_notes": "Vulnerability CVE-2017-5650 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2017-5650"
      },
      "action_statement": "Vulnerability CVE-2017-5650 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-29T02:36:49.908127+00:00",
      "status_notes": "Vulnerability CVE-2017-5664 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2017-5664"
      },
      "action_statement": "Vulnerability CVE-2017-5664 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-29T02:36:49.908127+00:00",
      "status_notes": "Vulnerability CVE-2017-7674 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2017-7674"
      },
      "action_statement": "Vulnerability CVE-2017-7674 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-30T14:21:53.066702+00:00",
      "status_notes": "Vulnerability CVE-2017-7675 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2017-7675"
      },
      "action_statement": "Vulnerability CVE-2017-7675 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-28T23:37:14.382670+00:00",
      "status_notes": "Vulnerability CVE-2019-0221 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2019-0221"
      },
      "action_statement": "Vulnerability CVE-2019-0221 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability CVE-2019-17569 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2019-17569"
      },
      "action_statement": "Vulnerability CVE-2019-17569 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2020-11996 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2020-11996"
      },
      "action_statement": "Vulnerability CVE-2020-11996 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2020-13934 does not affect version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat. CVE-2020-13934 affects Apache Tomcat 9.0.0.M5-9.0.36",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-13934"
      },
      "impact_statement": "CVE-2020-13934 affects Apache Tomcat 9.0.0.M5-9.0.36"
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2020-13935 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2020-13935"
      },
      "action_statement": "Vulnerability CVE-2020-13935 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-28T23:33:09.807961+00:00",
      "status_notes": "Vulnerability CVE-2020-1935 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2020-1935"
      },
      "action_statement": "Vulnerability CVE-2020-1935 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-30T14:09:00.258382+00:00",
      "status_notes": "Vulnerability CVE-2020-8022 is a false positive for org.apache.tomcat:tomcat 9.0.90-tuxcare.8.",
      "vulnerability": {
        "name": "CVE-2020-8022"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2021-30639 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2021-30639"
      },
      "action_statement": "Vulnerability CVE-2021-30639 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2021-30640 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2021-30640"
      },
      "action_statement": "Vulnerability CVE-2021-30640 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-30T04:34:00.136956+00:00",
      "status_notes": "Vulnerability CVE-2021-33037 does not affect version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat. not_affected \u2014 Target Tomcat 9.0.90 is not affected by CVE-2021-33037. All three required fixes from the upstream Apache Tomcat project are present in the codebase: (1) Transfer-Encoding header processing for HTTP/1.0 clients, (2) rejection of \"identity\" encoding with 501 status, and (3) validation that chunked encoding is the final encoding in the list. These fixes were included in the upstream Tomcat 9.0.90...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-33037"
      },
      "impact_statement": "not_affected \u2014 Target Tomcat 9.0.90 is not affected by CVE-2021-33037. All three required fixes from the upstream Apache Tomcat project are present in the codebase: (1) Transfer-Encoding header processing for HTTP/1.0 clients, (2) rejection of \"identity\" encoding with 501 status, and (3) validation that chunked encoding is the final encoding in the list. These fixes were included in the upstream Tomcat 9.0.90..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2021-41079 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2021-41079"
      },
      "action_statement": "Vulnerability CVE-2021-41079 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-42340 does not affect version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat. Patches already applied: 31d62426645824bdfe076a0c0eafa904d90b4fb9 (already in target via 80f1438ec4 'Close WebConnection', a37a6d312c 'Fix BZ 68884 - improve handling of large scale WebSocket disconnects')",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-42340"
      },
      "impact_statement": "Patches already applied: 31d62426645824bdfe076a0c0eafa904d90b4fb9 (already in target via 80f1438ec4 'Close WebConnection', a37a6d312c 'Fix BZ 68884 - improve handling of large scale WebSocket disconnects')"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-30T01:37:00.099833+00:00",
      "status_notes": "Vulnerability CVE-2021-43980 does not affect version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2021-43980 does not affect Apache Tomcat 9.0.90. The vulnerability was a concurrency bug where client connections could share an Http11Processor instance, causing responses to be delivered to the wrong client. The fix (atomic processor ownership management via takeCurrentProcessor()) was introduced by Apache in version 9.0.61 (commit 170e0f792bd1) and is present in the upstream 9.0.90 relea...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-43980"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-43980 does not affect Apache Tomcat 9.0.90. The vulnerability was a concurrency bug where client connections could share an Http11Processor instance, causing responses to be delivered to the wrong client. The fix (atomic processor ownership management via takeCurrentProcessor()) was introduced by Apache in version 9.0.61 (commit 170e0f792bd1) and is present in the upstream 9.0.90 relea..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-28T21:19:00.657885+00:00",
      "status_notes": "Vulnerability CVE-2022-23181 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2022-23181"
      },
      "action_statement": "Vulnerability CVE-2022-23181 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2022-25762 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2022-25762"
      },
      "action_statement": "Vulnerability CVE-2022-25762 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-28T21:16:19.887305+00:00",
      "status_notes": "Vulnerability CVE-2022-29885 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2022-29885"
      },
      "action_statement": "Vulnerability CVE-2022-29885 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2022-34305 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2022-34305"
      },
      "action_statement": "Vulnerability CVE-2022-34305 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-30T00:49:00.093458+00:00",
      "status_notes": "Vulnerability CVE-2023-41080 does not affect version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2023-41080 (open redirect via protocol-relative URLs in FORM authentication) is NOT present in Apache Tomcat 9.0.90. The upstream fix by Mark Thomas (commit 77c0ce2d169) was already included in the 9.0.90 release that TuxCare onboarded. The vulnerable pattern - multiple consecutive leading slashes in redirect URLs that could be exploited as protocol-relative redirects (e.g., \"//evil.com\") -...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-41080"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-41080 (open redirect via protocol-relative URLs in FORM authentication) is NOT present in Apache Tomcat 9.0.90. The upstream fix by Mark Thomas (commit 77c0ce2d169) was already included in the 9.0.90 release that TuxCare onboarded. The vulnerable pattern - multiple consecutive leading slashes in redirect URLs that could be exploited as protocol-relative redirects (e.g., \"//evil.com\") -..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-28T18:21:18.934330+00:00",
      "status_notes": "Vulnerability CVE-2023-42795 does not affect version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2023-42795 affects Apache Tomcat versions 9.0.0-M1 through 9.0.80 due to incomplete cleanup during recycling of internal objects. The target version 9.0.90 already contains the upstream fix (commit 44d05d75d6 by Mark Thomas from October 2023) that was shipped in the Apache Tomcat 9.0.81+ release. All vulnerable patterns have been addressed: part.delete(), session.endAccess(), asyncContext.r...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-42795"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-42795 affects Apache Tomcat versions 9.0.0-M1 through 9.0.80 due to incomplete cleanup during recycling of internal objects. The target version 9.0.90 already contains the upstream fix (commit 44d05d75d6 by Mark Thomas from October 2023) that was shipped in the Apache Tomcat 9.0.81+ release. All vulnerable patterns have been addressed: part.delete(), session.endAccess(), asyncContext.r..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-28T19:07:12.211534+00:00",
      "status_notes": "Vulnerability CVE-2023-45648 does not affect version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat. not_affected \u2014 Target version 9.0.90 is NOT AFFECTED by CVE-2023-45648. The vulnerable pattern (lack of trailer header validation) does not exist in this version. The upstream Apache Tomcat 9.0.90 release (May 2024) included an architectural refactoring that introduced HttpHeaderParser - a common header parser with built-in validation that prevents the vulnerability. The required defenses (rejecting non-token...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-45648"
      },
      "impact_statement": "not_affected \u2014 Target version 9.0.90 is NOT AFFECTED by CVE-2023-45648. The vulnerable pattern (lack of trailer header validation) does not exist in this version. The upstream Apache Tomcat 9.0.90 release (May 2024) included an architectural refactoring that introduced HttpHeaderParser - a common header parser with built-in validation that prevents the vulnerability. The required defenses (rejecting non-token..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-54677 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2024-54677"
      },
      "action_statement": "Vulnerability CVE-2024-54677 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-49124 is fixed in version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2025-49124"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-55752 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2025-55752"
      },
      "action_statement": "Vulnerability CVE-2025-55752 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-55754 is fixed in version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2025-55754"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-61795 is fixed in version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2025-61795"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-66614 is fixed in version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2025-66614"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-25854 is fixed in version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-25854"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability CVE-2026-29129 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-29129"
      },
      "action_statement": "Vulnerability CVE-2026-29129 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-29145 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-29145"
      },
      "action_statement": "Vulnerability CVE-2026-29145 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-29146 is fixed in version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-29146"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-32990 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-32990"
      },
      "action_statement": "Vulnerability CVE-2026-32990 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-34483 is fixed in version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-34483"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-34486 is fixed in version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-34486"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-34487 is fixed in version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-34487"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41284 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-41284"
      },
      "action_statement": "Vulnerability CVE-2026-41284 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41293 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-41293"
      },
      "action_statement": "Vulnerability CVE-2026-41293 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42498 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-42498"
      },
      "action_statement": "Vulnerability CVE-2026-42498 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-43512 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-43512"
      },
      "action_statement": "Vulnerability CVE-2026-43512 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-43513 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-43513"
      },
      "action_statement": "Vulnerability CVE-2026-43513 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-43514 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-43514"
      },
      "action_statement": "Vulnerability CVE-2026-43514 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-43515 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-43515"
      },
      "action_statement": "Vulnerability CVE-2026-43515 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-65182 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-65182"
      },
      "action_statement": "Vulnerability CVE-2026-65182 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-65905 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-65905"
      },
      "action_statement": "Vulnerability CVE-2026-65905 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.90-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-68525 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat.",
      "vulnerability": {
        "name": "CVE-2026-68525"
      },
      "action_statement": "Vulnerability CVE-2026-68525 affects version 9.0.90-tuxcare.8 of org.apache.tomcat:tomcat."
    }
  ]
}