{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:b3f9e1df-63f7-580c-92d9-3835f2ec21e4", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@9.0.83-tuxcare.1", "type": "library", "group": "org.apache.tomcat.embed", "name": "tomcat-embed-websocket", "version": "9.0.83-tuxcare.1", "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@9.0.83-tuxcare.1" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:73eee85e-96e4-57db-9bf9-7f92028c984a", "id": "CVE-2021-24122", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-24122 affects version 9.0.83-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, "affects": [ { "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@9.0.83-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:e252e964-ec37-5b92-a581-8b01b2fd9634", "id": "CVE-2022-45143", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-45143 does not affect version 9.0.83-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket. Apache Tomcat 9.0.83 is not affected by CVE-2022-45143. The upstream Apache fix (commit b336f4e58893ea35114f1e4a415657f723b1298e by Mark Thomas) was already present in the upstream 9.0.83 release, which serves as the base for this TuxCare branch. The JsonErrorReportValve properly escapes type, message, and description fields using JSONFilter.escape() before embedding them in JSON output, preventing the JSON injection vulnerability. The CVE affects versions 9.0.40 to 9.0.68; this version (9.0.83) is outside the affected range." }, "affects": [ { "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@9.0.83-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:7f6df0c3-dec8-51b5-864f-345acefc402a", "id": "CVE-2024-23672", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-23672 is fixed in version 9.0.83-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, "affects": [ { "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@9.0.83-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:d37bab0d-d62d-5f8f-8a6d-a973105ebee9", "id": "CVE-2024-24549", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-24549 is fixed in version 9.0.83-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, "affects": [ { "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@9.0.83-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:9584eb13-5e3c-541f-9a04-ac3989a65dac", "id": "CVE-2024-34750", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34750 is fixed in version 9.0.83-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, "affects": [ { "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@9.0.83-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b1159f24-c207-5cbb-b320-453f1d2d0100", "id": "CVE-2024-38286", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38286 is fixed in version 9.0.83-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, "affects": [ { "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@9.0.83-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:68244ea7-2d21-5c2a-aca3-83df42241f49", "id": "CVE-2024-50379", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-50379 is fixed in version 9.0.83-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, "affects": [ { "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@9.0.83-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:044e2655-a300-5a3e-b74a-343602bcae26", "id": "CVE-2024-52316", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-52316 is fixed in version 9.0.83-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, "affects": [ { "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@9.0.83-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:91f7a118-c785-5080-98da-c16bbc532579", "id": "CVE-2024-54677", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-54677 is fixed in version 9.0.83-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, "affects": [ { "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@9.0.83-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:881f0e7e-b7ef-5b09-9bb7-0083c30fdee6", "id": "CVE-2024-56337", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-56337 affects version 9.0.83-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, "affects": [ { "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@9.0.83-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:41cfb30c-a236-5897-a7eb-1b4a75e910bc", "id": "CVE-2025-24813", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-24813 is fixed in version 9.0.83-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, "affects": [ { "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@9.0.83-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:5279a576-892b-5f1b-bf07-249dffa4f159", "id": "CVE-2025-31650", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-31650 is fixed in version 9.0.83-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, "affects": [ { "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@9.0.83-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:4f7eb71c-ead2-5bc3-947f-233271f1c018", "id": "CVE-2025-31651", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31651 affects version 9.0.83-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, "affects": [ { "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@9.0.83-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b1032c3d-06dd-5cb8-a89e-63c22a56a879", "id": "CVE-2025-46701", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-46701 is fixed in version 9.0.83-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, "affects": [ { "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@9.0.83-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:9ef1fc9c-7894-59d4-974f-bad97ab64deb", "id": "CVE-2025-48988", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48988 is fixed in version 9.0.83-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, "affects": [ { "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@9.0.83-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:ef0ec4ef-e837-5783-b421-88f07b45542d", "id": "CVE-2025-48989", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48989 is fixed in version 9.0.83-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, "affects": [ { "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@9.0.83-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:bdcd1cf5-e527-5709-8563-1f710f2005a8", "id": "CVE-2025-49124", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-49124 is fixed in version 9.0.83-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, "affects": [ { "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@9.0.83-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:839c29d8-ce0d-5c1e-b7cf-5ceace7d6942", "id": "CVE-2025-49125", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-49125 is fixed in version 9.0.83-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, "affects": [ { "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@9.0.83-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:cb6c3db3-ebc2-5a05-bc90-5586b8cecb30", "id": "CVE-2025-52434", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-52434 is fixed in version 9.0.83-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, "affects": [ { "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@9.0.83-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:a21c5718-b5f0-51ad-842d-fb0eaeaeae28", "id": "CVE-2025-52520", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-52520 is fixed in version 9.0.83-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, "affects": [ { "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@9.0.83-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:193c8496-0092-5ed3-a1be-2eea679e591c", "id": "CVE-2025-53506", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-53506 is fixed in version 9.0.83-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, "affects": [ { "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@9.0.83-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:2ffdaddc-deb0-56e3-b66f-87cc8abae837", "id": "CVE-2025-55668", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-55668 is fixed in version 9.0.83-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, "affects": [ { "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@9.0.83-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:58d75c65-d8d9-59a1-84dd-ee4b73de2208", "id": "CVE-2025-55752", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55752 affects version 9.0.83-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, "affects": [ { "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@9.0.83-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:947b4776-388b-5769-947a-c8d3a2012ffa", "id": "CVE-2025-55754", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55754 affects version 9.0.83-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, "affects": [ { "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@9.0.83-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:3a72137c-e517-539b-b3f8-390a38260679", "id": "CVE-2025-61795", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-61795 affects version 9.0.83-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, "affects": [ { "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@9.0.83-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:178d18fd-07ea-5b20-8e7d-5657e989e85b", "id": "CVE-2025-66614", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66614 affects version 9.0.83-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, "affects": [ { "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@9.0.83-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:8f63c2c1-ae88-5092-a923-ce8daa537759", "id": "CVE-2026-24733", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24733 affects version 9.0.83-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, "affects": [ { "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@9.0.83-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:a7637644-e98b-53b1-8d10-98562668cdff", "id": "CVE-2026-24734", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24734 affects version 9.0.83-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, "affects": [ { "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@9.0.83-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:53046729-0b35-5f13-bf6b-e2baae559e43", "id": "CVE-2026-24880", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24880 affects version 9.0.83-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, "affects": [ { "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@9.0.83-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:9fbb37b9-2f14-5b06-aa5f-e5162b0a3bed", "id": "CVE-2026-25854", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-25854 affects version 9.0.83-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, "affects": [ { "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@9.0.83-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:a27994da-4130-549c-b3cf-528534608d21", "id": "CVE-2026-29146", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-29146 affects version 9.0.83-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, "affects": [ { "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@9.0.83-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:db38ff0e-445c-5493-b532-2e74f5633bb5", "id": "CVE-2026-34483", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34483 affects version 9.0.83-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, "affects": [ { "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@9.0.83-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:fafeafd6-97b8-526d-a42e-9d12ab093b5b", "id": "CVE-2026-34486", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34486 affects version 9.0.83-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, "affects": [ { "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@9.0.83-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:37f16b43-7e8b-573c-9b85-33eb0b6a6623", "id": "CVE-2026-34487", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34487 affects version 9.0.83-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, "affects": [ { "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@9.0.83-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:76f17101-d55a-57d6-b6f6-c8095083186e", "id": "CVE-2026-41284", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41284 affects version 9.0.83-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, "affects": [ { "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@9.0.83-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:a45cd3ae-a37a-597e-a784-6436cf0a4e80", "id": "CVE-2026-41293", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41293 affects version 9.0.83-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, "affects": [ { "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@9.0.83-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:aeada405-5e8c-5245-9eb9-15b3f2247868", "id": "CVE-2026-42498", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42498 affects version 9.0.83-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, "affects": [ { "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@9.0.83-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:6ead91ca-3975-50f6-8945-a3c9de1363ce", "id": "CVE-2026-43512", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43512 affects version 9.0.83-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, "affects": [ { "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@9.0.83-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:6f3fe699-5bef-500e-a07b-97cc6eda8664", "id": "CVE-2026-43513", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43513 affects version 9.0.83-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, "affects": [ { "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@9.0.83-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:50f10a8c-0a8c-5887-a619-1dd326c78573", "id": "CVE-2026-43514", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43514 affects version 9.0.83-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, "affects": [ { "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@9.0.83-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:ec01f34d-6677-55c5-878a-c9635123b67c", "id": "CVE-2026-43515", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43515 affects version 9.0.83-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-websocket." }, "affects": [ { "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@9.0.83-tuxcare.1" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@9.0.83-tuxcare.1" } ] }