{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:6cf00d0f-0f5e-556f-8160-a2675b94ad27", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat-embed-programmatic", "purl": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@10.1.16-tuxcare.1", "type": "library", "group": "org.apache.tomcat.experimental", "bom-ref": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@10.1.16-tuxcare.1", "version": "10.1.16-tuxcare.1", "pedigree": { "ancestors": [ { "name": "tomcat-embed-programmatic", "purl": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@10.1.16", "type": "library", "group": "org.apache.tomcat.experimental", "version": "10.1.16" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-23672", "affects": [ { "ref": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:416e30bb-a614-5643-849a-653c1ab6949b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-23672 affects version 10.1.16-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic." } }, { "id": "CVE-2024-24549", "affects": [ { "ref": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:0b2ee68e-4e12-5a9b-afe7-78904e6d57f8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-24549 affects version 10.1.16-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic." } }, { "id": "CVE-2024-34750", "affects": [ { "ref": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:29a664f5-0c5b-59d4-8d36-2b0737f96896", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34750 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic." } }, { "id": "CVE-2024-38286", "affects": [ { "ref": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:43a275bb-fd23-50ad-9c7b-d6c77e03feec", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38286 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic." } }, { "id": "CVE-2024-50379", "affects": [ { "ref": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:dceedbb3-c66c-54c4-b08b-0f7bd779e1d9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-50379 affects version 10.1.16-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic." } }, { "id": "CVE-2024-52316", "affects": [ { "ref": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:fa0446f5-eb61-5a19-8622-f21c9274a7f3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-52316 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic." } }, { "id": "CVE-2024-54677", "affects": [ { "ref": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:6802bfda-e47a-5991-b93a-f51a6ee1db38", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-54677 affects version 10.1.16-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic." } }, { "id": "CVE-2024-56337", "affects": [ { "ref": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:7e2d0f34-3019-5001-b956-38a04db3162c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-56337 affects version 10.1.16-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic." } }, { "id": "CVE-2025-24813", "affects": [ { "ref": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:d8db7b0b-21b4-5d5e-b73b-12e36ac885b3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-24813 affects version 10.1.16-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic." } }, { "id": "CVE-2025-31650", "affects": [ { "ref": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:828c3a03-def7-5a20-888d-298ded14a78c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31650 affects version 10.1.16-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic." } }, { "id": "CVE-2025-31651", "affects": [ { "ref": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:aac9b49c-aab9-538b-87be-1489b82d60af", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31651 affects version 10.1.16-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic." } }, { "id": "CVE-2025-46701", "affects": [ { "ref": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:580ef82a-9162-541d-941d-984ea5c7a9f5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-46701 affects version 10.1.16-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic." } }, { "id": "CVE-2025-48988", "affects": [ { "ref": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:a97e3baf-e374-53e2-8c6a-f83636adfcc7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-48988 affects version 10.1.16-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic." } }, { "id": "CVE-2025-48989", "affects": [ { "ref": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:3e66ce62-7ac2-5c01-9cc0-d84dad42c5c6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48989 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic." } }, { "id": "CVE-2025-49124", "affects": [ { "ref": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:ce2f7e8a-5129-5ff3-9eac-0c4cf47b6ffb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49124 affects version 10.1.16-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic." } }, { "id": "CVE-2025-49125", "affects": [ { "ref": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:fcecba87-b2f7-5095-8856-338fb85fc0c1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49125 affects version 10.1.16-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic." } }, { "id": "CVE-2025-52520", "affects": [ { "ref": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:d1e8aeda-53a3-5204-bca0-eeadf379c595", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-52520 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic." } }, { "id": "CVE-2025-53506", "affects": [ { "ref": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:248e65f9-6910-5260-9ed4-80a1e5527586", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-53506 affects version 10.1.16-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic." } }, { "id": "CVE-2025-55668", "affects": [ { "ref": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:6bae8b84-9981-50e8-94f1-b44401a48e71", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55668 affects version 10.1.16-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic." } }, { "id": "CVE-2025-55752", "affects": [ { "ref": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:612cc24c-3de5-5166-b29b-cc41e13204d6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-55752 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic. Version 10.1.16 is NOT vulnerable to CVE-2025-55752. The vulnerable code pattern (normalizing before decoding in RewriteValve) was introduced later in version 10.1.40. Version 10.1.16 uses a different code structure that does not call URLDecoder.decode after RequestUtil.normalize, thus the vulnerability is not present. The CVE advisory's version range \"10.1.0-M1 through 10.1.44\" is over-broad; only versions 10.1.40-10.1.44 contain the vulnerable pattern.", "justification": "code_not_present" } }, { "id": "CVE-2025-55754", "affects": [ { "ref": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:9cc7e1d4-d200-5e25-a08c-76948fbe1121", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55754 affects version 10.1.16-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic." } }, { "id": "CVE-2025-61795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:327943a4-cb55-5d2a-81f4-a9f52e828e79", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-61795 affects version 10.1.16-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic." } }, { "id": "CVE-2025-66614", "affects": [ { "ref": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:a4996ea1-6b48-5417-892f-36d4b4254f49", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66614 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic." } }, { "id": "CVE-2026-24733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:4b601c6a-0829-5706-8fa7-7e113c6765c0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24733 affects version 10.1.16-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic." } }, { "id": "CVE-2026-24734", "affects": [ { "ref": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:a039f629-d80e-5ffb-9a75-be9c9041f23d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24734 affects version 10.1.16-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic." } }, { "id": "CVE-2026-24880", "affects": [ { "ref": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:6f95f291-ca76-534a-97b1-47b14ea2cdc7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24880 affects version 10.1.16-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic." } }, { "id": "CVE-2026-25854", "affects": [ { "ref": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:0bce6482-0287-59f7-bed7-193b62337e5e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25854 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic." } }, { "id": "CVE-2026-29145", "affects": [ { "ref": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:aae2a527-ec44-5009-ae87-f8941f9bae5a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29145 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic." } }, { "id": "CVE-2026-29146", "affects": [ { "ref": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:0d97b93d-645c-5328-b53b-1e2eb66bf1bb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29146 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic." } }, { "id": "CVE-2026-32990", "affects": [ { "ref": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:64a2fba8-bcad-5fad-91b7-c6e56a15d8d5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-32990 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic. not_affected \u2014 Apache Tomcat 10.1.16 is not affected by CVE-2026-32990. The vulnerability exists in the checkSni() method's incomplete fix for CVE-2025-66614, affecting versions 10.1.50-10.1.52. Version 10.1.16 predates the introduction of the strict SNI validation feature entirely - the checkSni method, strictSni field, and protocolHostName parameter do not exist in this version. The vulnerability pattern (c...", "justification": "code_not_present" } }, { "id": "CVE-2026-34483", "affects": [ { "ref": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:c5eb8ecf-7395-5b12-a6ca-45e8650f3fb6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34483 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic." } }, { "id": "CVE-2026-34487", "affects": [ { "ref": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:981ace1f-1fd8-53d5-948c-e505b62d1931", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34487 affects version 10.1.16-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic." } }, { "id": "CVE-2026-41284", "affects": [ { "ref": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:115093d1-4b11-5b44-9188-e337442072dc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41284 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic." } }, { "id": "CVE-2026-41293", "affects": [ { "ref": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:fe44cd0b-c19f-55ad-b002-545296140495", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41293 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic." } }, { "id": "CVE-2026-42498", "affects": [ { "ref": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:59a1a2b7-9652-54ee-aeef-e4affdc65539", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42498 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic." } }, { "id": "CVE-2026-43512", "affects": [ { "ref": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:d6cf8b5d-6ed5-5b4c-afcc-a036c4bc402c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43512 affects version 10.1.16-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic." } }, { "id": "CVE-2026-43513", "affects": [ { "ref": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:29f12c3b-ac2c-52a0-9065-3def6d636dc8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43513 affects version 10.1.16-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic." } }, { "id": "CVE-2026-43514", "affects": [ { "ref": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:0a79f595-78ae-519b-b398-2e2fd42fbcdd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43514 affects version 10.1.16-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic." } }, { "id": "CVE-2026-43515", "affects": [ { "ref": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:fbb3787b-0d12-58ce-ad9f-fd75b39dc157", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-43515 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic." } }, { "id": "CVE-2026-53434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:cd68e6df-3f13-51f0-86be-2e0f4a900398", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53434 affects version 10.1.16-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic." } }, { "id": "CVE-2026-65182", "affects": [ { "ref": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:162694f4-4e03-51f1-9bb1-a36203780d46", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65182 affects version 10.1.16-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic." } }, { "id": "CVE-2026-65905", "affects": [ { "ref": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:b0d689d7-b3ab-51f7-ba80-817e3df54ead", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65905 affects version 10.1.16-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic." } }, { "id": "CVE-2026-68525", "affects": [ { "ref": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:b55a4e7b-c223-5b22-ad60-bfb09aa27810", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68525 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat.experimental:tomcat-embed-programmatic." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat.experimental/tomcat-embed-programmatic@10.1.16-tuxcare.1" } ] }