{ "@id": "urn:uuid:d43f7ae2-4169-4a64-909c-43ceb3feb63d", "role": "Document Creator", "author": "https://tuxcare.com", "version": 4, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-10-26T10:37:50.773574+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1" } } ], "timestamp": "2026-10-22T13:49:52.384446+00:00", "status_notes": "Vulnerability CVE-2020-11996 does not affect version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic. CVE-2020-11996 affects Apache Tomcat 9.0.0.M1 to 9.0.35. Target version 9.0.39 (released Oct 2020) already contains the upstream Apache fix from May 2020. The vulnerable closeIdleStreams() method that caused O(n) CPU exhaustion through iterating over large stream ID gaps has been replaced with an efficient subMap() implementation that only iterates over actual existing streams. Vulnerable pattern is not present in the shipped version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11996" }, "impact_statement": "CVE-2020-11996 affects Apache Tomcat 9.0.0.M1 to 9.0.35. Target version 9.0.39 (released Oct 2020) already contains the upstream Apache fix from May 2020. The vulnerable closeIdleStreams() method that caused O(n) CPU exhaustion through iterating over large stream ID gaps has been replaced with an efficient subMap() implementation that only iterates over actual existing streams. Vulnerable pattern is not present in the shipped version." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1" } } ], "timestamp": "2026-10-22T13:49:52.384446+00:00", "status_notes": "Vulnerability CVE-2020-13934 does not affect version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic. Target is Apache Tomcat 9.0.39 (tag 6989c4e936, product identity confirmed via ServerInfo.properties + repo layout). CVE-2020-13934 is a memory-exhaustion DoS: on a direct h2c (HTTP/2 cleartext, prior-knowledge) connection, Tomcat upgraded the HTTP/1.1 processor to an HTTP/2 processor WITHOUT releasing/recycling the old Http11Processor, leaking one processor per such connection until OutOfMemoryError. CVE affected range: 9.0.0.M5\u20139.0.36 (fixed 9.0.37). The upstream fix (commit 172977f04a by Mark Thomas , \"Ensure HTTP/1.1 processor is recycled after a direct h2c connection\") IS an ancestor of HEAD, and the current code at java/org/apache/coyote/AbstractProtocol.java exactly matches the post-fix state: line 880 adds `release(processor);` before swapping to the upgrade processor, and line 893 uses `state = SocketState.CLOSED;` (exit loop \u2192 clean-up) instead of the pre-fix `return SocketState.CLOSED;`. The pre-fix vulnerable pattern is absent. Fix author is upstream Apache (apache.org), not TuxCare/CloudLinux, so verdict is not_affected (vendor-fix) with justification code_not_present, not already_fixed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-13934" }, "impact_statement": "Target is Apache Tomcat 9.0.39 (tag 6989c4e936, product identity confirmed via ServerInfo.properties + repo layout). CVE-2020-13934 is a memory-exhaustion DoS: on a direct h2c (HTTP/2 cleartext, prior-knowledge) connection, Tomcat upgraded the HTTP/1.1 processor to an HTTP/2 processor WITHOUT releasing/recycling the old Http11Processor, leaking one processor per such connection until OutOfMemoryError. CVE affected range: 9.0.0.M5\u20139.0.36 (fixed 9.0.37). The upstream fix (commit 172977f04a by Mark Thomas , \"Ensure HTTP/1.1 processor is recycled after a direct h2c connection\") IS an ancestor of HEAD, and the current code at java/org/apache/coyote/AbstractProtocol.java exactly matches the post-fix state: line 880 adds `release(processor);` before swapping to the upgrade processor, and line 893 uses `state = SocketState.CLOSED;` (exit loop \u2192 clean-up) instead of the pre-fix `return SocketState.CLOSED;`. The pre-fix vulnerable pattern is absent. Fix author is upstream Apache (apache.org), not TuxCare/CloudLinux, so verdict is not_affected (vendor-fix) with justification code_not_present, not already_fixed." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1" } } ], "timestamp": "2026-10-22T13:49:52.384446+00:00", "status_notes": "Vulnerability CVE-2020-13943 does not affect version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic. not_affected \u2014 Apache Tomcat 9.0.39 is not affected by CVE-2020-13943. The vulnerability affected versions 9.0.0.M1 to 9.0.37. The target version (9.0.39) already contains the upstream fix (commit 55911430df) authored by Mark Thomas , which moved the maxConcurrentStreams validation from headersStart() to headersEnd(), preventing HTTP/2 header confusion between requests.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-13943" }, "impact_statement": "not_affected \u2014 Apache Tomcat 9.0.39 is not affected by CVE-2020-13943. The vulnerability affected versions 9.0.0.M1 to 9.0.37. The target version (9.0.39) already contains the upstream fix (commit 55911430df) authored by Mark Thomas , which moved the maxConcurrentStreams validation from headersStart() to headersEnd(), preventing HTTP/2 header confusion between requests." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1" } } ], "timestamp": "2026-10-22T13:49:52.384446+00:00", "status_notes": "Vulnerability CVE-2020-17527 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic.", "vulnerability": { "name": "CVE-2020-17527" }, "action_statement": "Vulnerability CVE-2020-17527 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1" } } ], "timestamp": "2026-10-22T13:49:52.384446+00:00", "status_notes": "Vulnerability CVE-2020-9484 does not affect version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic. Target is Apache Tomcat 9.0.39 (SHA 6989c4e9). CVE-2020-9484 is a deserialization RCE: an attacker-controlled session id (e.g. a JSESSIONID containing \"../\" sequences) makes org.apache.catalina.session.FileStore construct a path escaping its storage directory and deserialize an attacker-planted file. The vendor fix (Apache commit 3aa8f28db7, \"Improve validation of storage location when using FileStore.\") adds a canonical-path containment check to FileStore.file(). That exact fix is present in 9.0.39: FileStore.java lines 344-360 contain `if (!file.getCanonicalPath().startsWith(storageDir.getCanonicalPath())) { log.warn(\"fileStore.invalid\"...); return null; }`, and LocalStrings.properties:33 defines the fileStore.invalid message. The check is on every execution path to deserialization (load() calls file(id) at line 217 and short-circuits at line 218 before the ObjectInputStream at line 232; remove() and save() also route through file()). CVE lists affected 9.0.0.M1-9.0.34; the fix shipped in 9.0.35, so 9.0.39 is post-fix \u2014 verified by code, not metadata. Fix commit author is markt@apache.org (upstream Apache), not a TuxCare/CloudLinux backport; the only TuxCare backports present target other CVEs on other branches (9.0.24, 10.1.33). Hence not_affected via an upstream-authored fix already in the shipped version (code_not_present).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-9484" }, "impact_statement": "Target is Apache Tomcat 9.0.39 (SHA 6989c4e9). CVE-2020-9484 is a deserialization RCE: an attacker-controlled session id (e.g. a JSESSIONID containing \"../\" sequences) makes org.apache.catalina.session.FileStore construct a path escaping its storage directory and deserialize an attacker-planted file. The vendor fix (Apache commit 3aa8f28db7, \"Improve validation of storage location when using FileStore.\") adds a canonical-path containment check to FileStore.file(). That exact fix is present in 9.0.39: FileStore.java lines 344-360 contain `if (!file.getCanonicalPath().startsWith(storageDir.getCanonicalPath())) { log.warn(\"fileStore.invalid\"...); return null; }`, and LocalStrings.properties:33 defines the fileStore.invalid message. The check is on every execution path to deserialization (load() calls file(id) at line 217 and short-circuits at line 218 before the ObjectInputStream at line 232; remove() and save() also route through file()). CVE lists affected 9.0.0.M1-9.0.34; the fix shipped in 9.0.35, so 9.0.39 is post-fix \u2014 verified by code, not metadata. Fix commit author is markt@apache.org (upstream Apache), not a TuxCare/CloudLinux backport; the only TuxCare backports present target other CVEs on other branches (9.0.24, 10.1.33). Hence not_affected via an upstream-authored fix already in the shipped version (code_not_present)." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1" } } ], "timestamp": "2026-10-22T13:49:52.384446+00:00", "status_notes": "Vulnerability CVE-2021-24122 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic.", "vulnerability": { "name": "CVE-2021-24122" }, "action_statement": "Vulnerability CVE-2021-24122 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1" } } ], "timestamp": "2026-10-22T13:49:52.384446+00:00", "status_notes": "Vulnerability CVE-2021-25122 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic.", "vulnerability": { "name": "CVE-2021-25122" }, "action_statement": "Vulnerability CVE-2021-25122 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1" } } ], "timestamp": "2026-10-22T13:50:00.925739+00:00", "status_notes": "Vulnerability CVE-2021-25329 is fixed in version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic.", "vulnerability": { "name": "CVE-2021-25329" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1" } } ], "timestamp": "2026-10-22T13:49:52.384446+00:00", "status_notes": "Vulnerability CVE-2021-30639 does not affect version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic. Apache Tomcat 9.0.39 is not affected by CVE-2021-30639. The vulnerability was introduced in version 9.0.44 when the errorException field was added to Request.java without proper recycling. Version 9.0.39 predates this change and does not contain the errorException field at all, making the vulnerability impossible to manifest.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-30639" }, "impact_statement": "Apache Tomcat 9.0.39 is not affected by CVE-2021-30639. The vulnerability was introduced in version 9.0.44 when the errorException field was added to Request.java without proper recycling. Version 9.0.39 predates this change and does not contain the errorException field at all, making the vulnerability impossible to manifest." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1" } } ], "timestamp": "2026-10-22T13:49:52.384446+00:00", "status_notes": "Vulnerability CVE-2021-30640 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic.", "vulnerability": { "name": "CVE-2021-30640" }, "action_statement": "Vulnerability CVE-2021-30640 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1" } } ], "timestamp": "2026-10-26T10:37:50.773574+00:00", "status_notes": "Vulnerability CVE-2021-33037 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic, and is fixed in 9.0.39-tuxcare.2.", "vulnerability": { "name": "CVE-2021-33037" }, "action_statement": "Vulnerability CVE-2021-33037 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic, and is fixed in 9.0.39-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1" } } ], "timestamp": "2026-10-22T13:49:52.384446+00:00", "status_notes": "Vulnerability CVE-2021-41079 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic.", "vulnerability": { "name": "CVE-2021-41079" }, "action_statement": "Vulnerability CVE-2021-41079 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1" } } ], "timestamp": "2026-10-22T13:49:52.384446+00:00", "status_notes": "Vulnerability CVE-2021-42340 does not affect version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic. Tomcat 9.0.39 is not affected by CVE-2021-42340. This CVE describes a memory leak introduced by the fix for bug 63362, which was first applied in version 9.0.40. The vulnerable code (UpgradeInfo/UpgradeGroupInfo classes for collecting HTTP upgrade connection metrics) does not exist in version 9.0.39, making the memory leak pattern unreachable.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-42340" }, "impact_statement": "Tomcat 9.0.39 is not affected by CVE-2021-42340. This CVE describes a memory leak introduced by the fix for bug 63362, which was first applied in version 9.0.40. The vulnerable code (UpgradeInfo/UpgradeGroupInfo classes for collecting HTTP upgrade connection metrics) does not exist in version 9.0.39, making the memory leak pattern unreachable." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1" } } ], "timestamp": "2026-10-22T13:50:22.139895+00:00", "status_notes": "Vulnerability CVE-2021-43980 is fixed in version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic.", "vulnerability": { "name": "CVE-2021-43980" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1" } } ], "timestamp": "2026-10-26T10:37:50.773574+00:00", "status_notes": "Vulnerability CVE-2022-23181 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic, and is fixed in 9.0.39-tuxcare.2.", "vulnerability": { "name": "CVE-2022-23181" }, "action_statement": "Vulnerability CVE-2022-23181 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic, and is fixed in 9.0.39-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1" } } ], "timestamp": "2026-10-26T10:37:50.773574+00:00", "status_notes": "Vulnerability CVE-2022-29885 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic, and is fixed in 9.0.39-tuxcare.2.", "vulnerability": { "name": "CVE-2022-29885" }, "action_statement": "Vulnerability CVE-2022-29885 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic, and is fixed in 9.0.39-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1" } } ], "timestamp": "2026-10-26T10:37:50.773574+00:00", "status_notes": "Vulnerability CVE-2022-34305 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic, and is fixed in 9.0.39-tuxcare.2.", "vulnerability": { "name": "CVE-2022-34305" }, "action_statement": "Vulnerability CVE-2022-34305 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic, and is fixed in 9.0.39-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1" } } ], "timestamp": "2026-10-26T10:37:50.773574+00:00", "status_notes": "Vulnerability CVE-2022-42252 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic, and is fixed in 9.0.39-tuxcare.2.", "vulnerability": { "name": "CVE-2022-42252" }, "action_statement": "Vulnerability CVE-2022-42252 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic, and is fixed in 9.0.39-tuxcare.2." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1" } } ], "timestamp": "2026-10-22T13:49:52.384446+00:00", "status_notes": "Vulnerability CVE-2022-45143 does not affect version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic. Apache Tomcat 9.0.39 is not affected by CVE-2022-45143. The vulnerable component (JsonErrorReportValve) does not exist in this version. JsonErrorReportValve was first introduced in version 9.0.40 (commit 295709303f), which is one version after the target. The CVE's stated affected range (9.0.40 to 9.0.68) correctly excludes 9.0.39. This is a Rule 5 Type A1 case: the component that receives the malicious input is absent from the codebase.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-45143" }, "impact_statement": "Apache Tomcat 9.0.39 is not affected by CVE-2022-45143. The vulnerable component (JsonErrorReportValve) does not exist in this version. JsonErrorReportValve was first introduced in version 9.0.40 (commit 295709303f), which is one version after the target. The CVE's stated affected range (9.0.40 to 9.0.68) correctly excludes 9.0.39. This is a Rule 5 Type A1 case: the component that receives the malicious input is absent from the codebase." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1" } } ], "timestamp": "2026-10-26T10:37:50.773574+00:00", "status_notes": "Vulnerability CVE-2023-24998 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic, and is fixed in 9.0.39-tuxcare.2.", "vulnerability": { "name": "CVE-2023-24998" }, "action_statement": "Vulnerability CVE-2023-24998 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic, and is fixed in 9.0.39-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1" } } ], "timestamp": "2026-10-26T10:37:50.773574+00:00", "status_notes": "Vulnerability CVE-2023-28708 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic, and is fixed in 9.0.39-tuxcare.2.", "vulnerability": { "name": "CVE-2023-28708" }, "action_statement": "Vulnerability CVE-2023-28708 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic, and is fixed in 9.0.39-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1" } } ], "timestamp": "2026-10-26T10:37:50.773574+00:00", "status_notes": "Vulnerability CVE-2023-41080 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic, and is fixed in 9.0.39-tuxcare.2.", "vulnerability": { "name": "CVE-2023-41080" }, "action_statement": "Vulnerability CVE-2023-41080 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic, and is fixed in 9.0.39-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1" } } ], "timestamp": "2026-10-26T10:37:50.773574+00:00", "status_notes": "Vulnerability CVE-2023-42795 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic, and is fixed in 9.0.39-tuxcare.2.", "vulnerability": { "name": "CVE-2023-42795" }, "action_statement": "Vulnerability CVE-2023-42795 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic, and is fixed in 9.0.39-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1" } } ], "timestamp": "2026-10-26T10:37:50.773574+00:00", "status_notes": "Vulnerability CVE-2023-44487 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic, and is fixed in 9.0.39-tuxcare.2.", "vulnerability": { "name": "CVE-2023-44487" }, "action_statement": "Vulnerability CVE-2023-44487 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic, and is fixed in 9.0.39-tuxcare.2." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1" } } ], "timestamp": "2026-10-22T13:50:22.139895+00:00", "status_notes": "Vulnerability CVE-2023-45648 is fixed in version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic.", "vulnerability": { "name": "CVE-2023-45648" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1" } } ], "timestamp": "2026-10-22T13:49:52.384446+00:00", "status_notes": "Vulnerability CVE-2023-46589 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic.", "vulnerability": { "name": "CVE-2023-46589" }, "action_statement": "Vulnerability CVE-2023-46589 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1" } } ], "timestamp": "2026-10-22T13:49:52.384446+00:00", "status_notes": "Vulnerability CVE-2024-21733 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic.", "vulnerability": { "name": "CVE-2024-21733" }, "action_statement": "Vulnerability CVE-2024-21733 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1" } } ], "timestamp": "2026-10-22T13:49:52.384446+00:00", "status_notes": "Vulnerability CVE-2024-23672 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic.", "vulnerability": { "name": "CVE-2024-23672" }, "action_statement": "Vulnerability CVE-2024-23672 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1" } } ], "timestamp": "2026-10-26T10:37:50.773574+00:00", "status_notes": "Vulnerability CVE-2024-24549 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic, and is fixed in 9.0.39-tuxcare.2.", "vulnerability": { "name": "CVE-2024-24549" }, "action_statement": "Vulnerability CVE-2024-24549 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic, and is fixed in 9.0.39-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1" } } ], "timestamp": "2026-10-22T13:49:52.384446+00:00", "status_notes": "Vulnerability CVE-2024-34750 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic.", "vulnerability": { "name": "CVE-2024-34750" }, "action_statement": "Vulnerability CVE-2024-34750 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1" } } ], "timestamp": "2026-10-26T10:37:50.773574+00:00", "status_notes": "Vulnerability CVE-2024-38286 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic, and is fixed in 9.0.39-tuxcare.2.", "vulnerability": { "name": "CVE-2024-38286" }, "action_statement": "Vulnerability CVE-2024-38286 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic, and is fixed in 9.0.39-tuxcare.2." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1" } } ], "timestamp": "2026-10-22T13:50:22.139895+00:00", "status_notes": "Vulnerability CVE-2024-50379 is fixed in version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic.", "vulnerability": { "name": "CVE-2024-50379" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1" } } ], "timestamp": "2026-10-26T10:37:50.773574+00:00", "status_notes": "Vulnerability CVE-2024-52316 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic, and is fixed in 9.0.39-tuxcare.2.", "vulnerability": { "name": "CVE-2024-52316" }, "action_statement": "Vulnerability CVE-2024-52316 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic, and is fixed in 9.0.39-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1" } } ], "timestamp": "2026-10-22T13:49:52.384446+00:00", "status_notes": "Vulnerability CVE-2024-54677 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic.", "vulnerability": { "name": "CVE-2024-54677" }, "action_statement": "Vulnerability CVE-2024-54677 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1" } } ], "timestamp": "2026-10-22T13:49:52.384446+00:00", "status_notes": "Vulnerability CVE-2024-56337 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic.", "vulnerability": { "name": "CVE-2024-56337" }, "action_statement": "Vulnerability CVE-2024-56337 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1" } } ], "timestamp": "2026-10-26T10:37:50.773574+00:00", "status_notes": "Vulnerability CVE-2025-24813 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic, and is fixed in 9.0.39-tuxcare.2.", "vulnerability": { "name": "CVE-2025-24813" }, "action_statement": "Vulnerability CVE-2025-24813 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic, and is fixed in 9.0.39-tuxcare.2." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1" } } ], "timestamp": "2026-10-22T13:49:52.384446+00:00", "status_notes": "Vulnerability CVE-2025-31650 does not affect version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic. Tomcat 9.0.39 does not have the vulnerable HTTP/2 priority (RFC 9218) feature. The Priority parser class, PRIORITY_UPDATE frame type, readPriorityUpdateFrame() method, and priority header processing do not exist in this version. RFC 9218 support was added in 2022-2023, after version 9.0.39 was released (2020-10-09). The vulnerability requires RFC 9218 priority field parsing, which is absent from this codebase.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-31650" }, "impact_statement": "Tomcat 9.0.39 does not have the vulnerable HTTP/2 priority (RFC 9218) feature. The Priority parser class, PRIORITY_UPDATE frame type, readPriorityUpdateFrame() method, and priority header processing do not exist in this version. RFC 9218 support was added in 2022-2023, after version 9.0.39 was released (2020-10-09). The vulnerability requires RFC 9218 priority field parsing, which is absent from this codebase." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1" } } ], "timestamp": "2026-10-22T13:49:52.384446+00:00", "status_notes": "Vulnerability CVE-2025-31651 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic.", "vulnerability": { "name": "CVE-2025-31651" }, "action_statement": "Vulnerability CVE-2025-31651 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1" } } ], "timestamp": "2026-10-26T10:37:50.773574+00:00", "status_notes": "Vulnerability CVE-2025-46701 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic, and is fixed in 9.0.39-tuxcare.2.", "vulnerability": { "name": "CVE-2025-46701" }, "action_statement": "Vulnerability CVE-2025-46701 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic, and is fixed in 9.0.39-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1" } } ], "timestamp": "2026-10-26T10:37:50.773574+00:00", "status_notes": "Vulnerability CVE-2025-48988 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic, and is fixed in 9.0.39-tuxcare.2.", "vulnerability": { "name": "CVE-2025-48988" }, "action_statement": "Vulnerability CVE-2025-48988 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic, and is fixed in 9.0.39-tuxcare.2." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1" } } ], "timestamp": "2026-10-22T13:50:22.139895+00:00", "status_notes": "Vulnerability CVE-2025-48989 is fixed in version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic.", "vulnerability": { "name": "CVE-2025-48989" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1" } } ], "timestamp": "2026-10-26T10:37:50.773574+00:00", "status_notes": "Vulnerability CVE-2025-49124 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic, and is fixed in 9.0.39-tuxcare.2.", "vulnerability": { "name": "CVE-2025-49124" }, "action_statement": "Vulnerability CVE-2025-49124 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic, and is fixed in 9.0.39-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1" } } ], "timestamp": "2026-10-26T10:37:50.773574+00:00", "status_notes": "Vulnerability CVE-2025-49125 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic, and is fixed in 9.0.39-tuxcare.2.", "vulnerability": { "name": "CVE-2025-49125" }, "action_statement": "Vulnerability CVE-2025-49125 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic, and is fixed in 9.0.39-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1" } } ], "timestamp": "2026-10-26T10:37:50.773574+00:00", "status_notes": "Vulnerability CVE-2025-52434 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic, and is fixed in 9.0.39-tuxcare.2.", "vulnerability": { "name": "CVE-2025-52434" }, "action_statement": "Vulnerability CVE-2025-52434 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic, and is fixed in 9.0.39-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1" } } ], "timestamp": "2026-10-26T10:37:50.773574+00:00", "status_notes": "Vulnerability CVE-2025-52520 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic, and is fixed in 9.0.39-tuxcare.2.", "vulnerability": { "name": "CVE-2025-52520" }, "action_statement": "Vulnerability CVE-2025-52520 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic, and is fixed in 9.0.39-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1" } } ], "timestamp": "2026-10-26T10:37:50.773574+00:00", "status_notes": "Vulnerability CVE-2025-53506 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic, and is fixed in 9.0.39-tuxcare.2.", "vulnerability": { "name": "CVE-2025-53506" }, "action_statement": "Vulnerability CVE-2025-53506 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic, and is fixed in 9.0.39-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1" } } ], "timestamp": "2026-10-26T10:37:50.773574+00:00", "status_notes": "Vulnerability CVE-2025-55668 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic, and is fixed in 9.0.39-tuxcare.2.", "vulnerability": { "name": "CVE-2025-55668" }, "action_statement": "Vulnerability CVE-2025-55668 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic, and is fixed in 9.0.39-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1" } } ], "timestamp": "2026-10-26T10:37:50.773574+00:00", "status_notes": "Vulnerability CVE-2025-55752 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic, and is fixed in 9.0.39-tuxcare.2.", "vulnerability": { "name": "CVE-2025-55752" }, "action_statement": "Vulnerability CVE-2025-55752 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic, and is fixed in 9.0.39-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1" } } ], "timestamp": "2026-10-26T10:37:50.773574+00:00", "status_notes": "Vulnerability CVE-2025-61795 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic, and is fixed in 9.0.39-tuxcare.2.", "vulnerability": { "name": "CVE-2025-61795" }, "action_statement": "Vulnerability CVE-2025-61795 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic, and is fixed in 9.0.39-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1" } } ], "timestamp": "2026-10-26T10:37:50.773574+00:00", "status_notes": "Vulnerability CVE-2025-66614 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic, and is fixed in 9.0.39-tuxcare.2.", "vulnerability": { "name": "CVE-2025-66614" }, "action_statement": "Vulnerability CVE-2025-66614 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic, and is fixed in 9.0.39-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1" } } ], "timestamp": "2026-10-26T10:37:50.773574+00:00", "status_notes": "Vulnerability CVE-2026-24733 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic, and is fixed in 9.0.39-tuxcare.2.", "vulnerability": { "name": "CVE-2026-24733" }, "action_statement": "Vulnerability CVE-2026-24733 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic, and is fixed in 9.0.39-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1" } } ], "timestamp": "2026-10-22T13:49:52.384446+00:00", "status_notes": "Vulnerability CVE-2026-24880 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic.", "vulnerability": { "name": "CVE-2026-24880" }, "action_statement": "Vulnerability CVE-2026-24880 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1" } } ], "timestamp": "2026-10-22T13:49:52.384446+00:00", "status_notes": "Vulnerability CVE-2026-25854 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic.", "vulnerability": { "name": "CVE-2026-25854" }, "action_statement": "Vulnerability CVE-2026-25854 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1" } } ], "timestamp": "2026-10-22T13:50:22.139895+00:00", "status_notes": "Vulnerability CVE-2026-29146 is fixed in version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic.", "vulnerability": { "name": "CVE-2026-29146" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1" } } ], "timestamp": "2026-10-22T13:49:52.384446+00:00", "status_notes": "Vulnerability CVE-2026-32990 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic.", "vulnerability": { "name": "CVE-2026-32990" }, "action_statement": "Vulnerability CVE-2026-32990 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1" } } ], "timestamp": "2026-10-22T13:49:52.384446+00:00", "status_notes": "Vulnerability CVE-2026-34487 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic.", "vulnerability": { "name": "CVE-2026-34487" }, "action_statement": "Vulnerability CVE-2026-34487 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1" } } ], "timestamp": "2026-10-22T13:49:52.384446+00:00", "status_notes": "Vulnerability CVE-2026-41284 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic.", "vulnerability": { "name": "CVE-2026-41284" }, "action_statement": "Vulnerability CVE-2026-41284 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1" } } ], "timestamp": "2026-10-22T13:49:52.384446+00:00", "status_notes": "Vulnerability CVE-2026-41293 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic.", "vulnerability": { "name": "CVE-2026-41293" }, "action_statement": "Vulnerability CVE-2026-41293 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1" } } ], "timestamp": "2026-10-22T13:49:52.384446+00:00", "status_notes": "Vulnerability CVE-2026-42498 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic.", "vulnerability": { "name": "CVE-2026-42498" }, "action_statement": "Vulnerability CVE-2026-42498 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1" } } ], "timestamp": "2026-10-22T13:49:52.384446+00:00", "status_notes": "Vulnerability CVE-2026-43512 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic.", "vulnerability": { "name": "CVE-2026-43512" }, "action_statement": "Vulnerability CVE-2026-43512 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1" } } ], "timestamp": "2026-10-22T13:49:52.384446+00:00", "status_notes": "Vulnerability CVE-2026-43513 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic.", "vulnerability": { "name": "CVE-2026-43513" }, "action_statement": "Vulnerability CVE-2026-43513 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1" } } ], "timestamp": "2026-10-22T13:49:52.384446+00:00", "status_notes": "Vulnerability CVE-2026-43514 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic.", "vulnerability": { "name": "CVE-2026-43514" }, "action_statement": "Vulnerability CVE-2026-43514 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1" } } ], "timestamp": "2026-10-22T13:49:52.384446+00:00", "status_notes": "Vulnerability CVE-2026-43515 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic.", "vulnerability": { "name": "CVE-2026-43515" }, "action_statement": "Vulnerability CVE-2026-43515 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1" } } ], "timestamp": "2026-10-22T13:49:52.384446+00:00", "status_notes": "Vulnerability CVE-2026-65182 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic.", "vulnerability": { "name": "CVE-2026-65182" }, "action_statement": "Vulnerability CVE-2026-65182 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1" } } ], "timestamp": "2026-10-22T13:49:52.384446+00:00", "status_notes": "Vulnerability CVE-2026-65905 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic.", "vulnerability": { "name": "CVE-2026-65905" }, "action_statement": "Vulnerability CVE-2026-65905 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@9.0.39-tuxcare.1" } } ], "timestamp": "2026-10-22T13:49:52.384446+00:00", "status_notes": "Vulnerability CVE-2026-68525 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic.", "vulnerability": { "name": "CVE-2026-68525" }, "action_statement": "Vulnerability CVE-2026-68525 affects version 9.0.39-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic." } ] }