{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:2a889c4d-400c-5aae-9d0a-85f3d0816da1", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat-annotations-api", "purl": "pkg:maven/org.apache.tomcat/tomcat-annotations-api@10.1.16-tuxcare.1", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-annotations-api@10.1.16-tuxcare.1", "version": "10.1.16-tuxcare.1", "pedigree": { "ancestors": [ { "name": "tomcat-annotations-api", "purl": "pkg:maven/org.apache.tomcat/tomcat-annotations-api@10.1.16", "type": "library", "group": "org.apache.tomcat", "version": "10.1.16" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-23672", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-annotations-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:2ea58761-ad34-528d-be80-24d5dd2b6231", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-23672 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-annotations-api." } }, { "id": "CVE-2024-24549", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-annotations-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:20a2910c-0bf8-5d4c-b570-544ddc4f0bcc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-24549 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-annotations-api." } }, { "id": "CVE-2024-34750", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-annotations-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:fd2a9d57-a03f-5a0c-bdb9-30913357bea3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34750 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-annotations-api." } }, { "id": "CVE-2024-38286", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-annotations-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:10b9e67e-6b6e-5143-bae1-3b826663457f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38286 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-annotations-api." } }, { "id": "CVE-2024-50379", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-annotations-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:66f82745-1016-5e0f-a748-86d73789a48b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-50379 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-annotations-api." } }, { "id": "CVE-2024-52316", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-annotations-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:aa81dae1-76d4-5ded-a8a9-032ee3c89c8b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-52316 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-annotations-api." } }, { "id": "CVE-2024-54677", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-annotations-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:821a521a-9c3f-5e70-882d-b861b62cf124", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-54677 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-annotations-api." } }, { "id": "CVE-2024-56337", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-annotations-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:a590dcb8-98dc-5e82-b718-a73614d6ae20", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-56337 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-annotations-api." } }, { "id": "CVE-2025-24813", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-annotations-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:f89291a4-ce52-5019-aa6a-3bded403b168", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-24813 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-annotations-api." } }, { "id": "CVE-2025-31650", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-annotations-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:3465e429-1767-5ded-907a-d381e8adbc20", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31650 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-annotations-api." } }, { "id": "CVE-2025-31651", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-annotations-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:a78b5d5d-e014-53ad-9564-cdc91a41410d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31651 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-annotations-api." } }, { "id": "CVE-2025-46701", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-annotations-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:4eaa9b6f-b390-5274-9fe1-2cca72c8cd44", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-46701 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-annotations-api." } }, { "id": "CVE-2025-48988", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-annotations-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:8f765843-7325-5cef-b452-ad9d4206cb5d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-48988 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-annotations-api." } }, { "id": "CVE-2025-48989", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-annotations-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:66047718-c2b8-5130-869b-f04fc8d01742", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48989 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-annotations-api." } }, { "id": "CVE-2025-49124", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-annotations-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:8ee0dd9a-49d6-5f82-b88a-8ed5f1766587", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49124 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-annotations-api." } }, { "id": "CVE-2025-49125", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-annotations-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:87ae48f2-0e77-51bd-bf7d-373844bd1e59", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49125 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-annotations-api." } }, { "id": "CVE-2025-52520", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-annotations-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:d395ae59-8b18-5a96-8b8a-55836b75e440", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-52520 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-annotations-api." } }, { "id": "CVE-2025-53506", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-annotations-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:32ef0bd2-3b22-5f70-8447-b94fb09b6c04", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-53506 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-annotations-api." } }, { "id": "CVE-2025-55668", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-annotations-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:ea106262-571a-598f-9565-19fe44ad1192", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55668 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-annotations-api." } }, { "id": "CVE-2025-55752", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-annotations-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:12d3c64b-8577-595d-92bf-6615b55a6618", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-55752 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-annotations-api. Version 10.1.16 is NOT vulnerable to CVE-2025-55752. The vulnerable code pattern (normalizing before decoding in RewriteValve) was introduced later in version 10.1.40. Version 10.1.16 uses a different code structure that does not call URLDecoder.decode after RequestUtil.normalize, thus the vulnerability is not present. The CVE advisory's version range \"10.1.0-M1 through 10.1.44\" is over-broad; only versions 10.1.40-10.1.44 contain the vulnerable pattern.", "justification": "code_not_present" } }, { "id": "CVE-2025-55754", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-annotations-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:8d04593b-8385-51b2-a58f-6343681599ad", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55754 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-annotations-api." } }, { "id": "CVE-2025-61795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-annotations-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:2f921c00-227c-5152-8201-dbc0ce225f7a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-61795 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-annotations-api." } }, { "id": "CVE-2025-66614", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-annotations-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:3461b154-e2d8-5fe3-a425-bbe8f887aa28", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66614 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-annotations-api." } }, { "id": "CVE-2026-24733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-annotations-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:f7fc97c3-7636-5ce8-8aa2-9d2ed7126c14", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24733 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-annotations-api." } }, { "id": "CVE-2026-24734", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-annotations-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:91d96741-7362-5b09-a0ff-d8f1a957aed6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24734 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-annotations-api." } }, { "id": "CVE-2026-24880", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-annotations-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:1d04a70d-6296-5ec2-ac6c-4f0598c73a17", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24880 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-annotations-api." } }, { "id": "CVE-2026-25854", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-annotations-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:2cf83af4-3f78-5d56-a7a9-e770dadfda72", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25854 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-annotations-api." } }, { "id": "CVE-2026-29145", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-annotations-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:9490310f-4b3c-5e5b-9236-719fd9b64e84", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29145 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-annotations-api." } }, { "id": "CVE-2026-29146", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-annotations-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:47b5a698-96ef-5d90-a0af-fea9da9ad0c0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29146 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-annotations-api." } }, { "id": "CVE-2026-32990", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-annotations-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:9885905c-ea4d-5cf6-add3-2ec2c598a303", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-32990 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-annotations-api. not_affected \u2014 Apache Tomcat 10.1.16 is not affected by CVE-2026-32990. The vulnerability exists in the checkSni() method's incomplete fix for CVE-2025-66614, affecting versions 10.1.50-10.1.52. Version 10.1.16 predates the introduction of the strict SNI validation feature entirely - the checkSni method, strictSni field, and protocolHostName parameter do not exist in this version. The vulnerability pattern (c...", "justification": "code_not_present" } }, { "id": "CVE-2026-34483", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-annotations-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:d0194cac-70e0-52d0-8fb5-5c2e5f03545d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34483 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-annotations-api." } }, { "id": "CVE-2026-34487", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-annotations-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:2da7c664-4540-545d-b7f4-c29c5295ff94", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34487 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-annotations-api." } }, { "id": "CVE-2026-41284", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-annotations-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:60b2d524-b6ad-590f-97ca-23c27f8ff79b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41284 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-annotations-api." } }, { "id": "CVE-2026-41293", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-annotations-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:50330764-f612-53ba-890d-151b3e7371aa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41293 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-annotations-api." } }, { "id": "CVE-2026-42498", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-annotations-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:050a1717-fcb6-58b1-83a4-1bdbbcb16f58", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42498 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-annotations-api." } }, { "id": "CVE-2026-43512", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-annotations-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:132afd56-b1a3-5a26-9926-bdaa7d0a36a6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43512 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-annotations-api." } }, { "id": "CVE-2026-43513", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-annotations-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:2bc57bda-9c1f-5082-81b8-fc70e475be6f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43513 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-annotations-api." } }, { "id": "CVE-2026-43514", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-annotations-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:b86416d7-dd5c-578c-a871-03dbba83e1b8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43514 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-annotations-api." } }, { "id": "CVE-2026-43515", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-annotations-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:ca8848df-479a-5839-bc3a-27c9e47d5091", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-43515 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-annotations-api." } }, { "id": "CVE-2026-53434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-annotations-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:03c888f1-b351-590b-93de-24158deb3487", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53434 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-annotations-api." } }, { "id": "CVE-2026-65182", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-annotations-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:42c6321d-f089-5c01-9b51-e9a3df3880f6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65182 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-annotations-api." } }, { "id": "CVE-2026-65905", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-annotations-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:9a10d88b-dc15-5a48-9f2f-7a5a81075989", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65905 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-annotations-api." } }, { "id": "CVE-2026-68525", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-annotations-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:d605199f-f603-518d-ac27-ec8d2bde1c04", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68525 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-annotations-api." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-annotations-api@10.1.16-tuxcare.1" } ] }