{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:d3394761-a0ef-599b-8301-084910a99d47", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat-catalina-ant", "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-ant@10.1.16-tuxcare.1", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ant@10.1.16-tuxcare.1", "version": "10.1.16-tuxcare.1", "pedigree": { "ancestors": [ { "name": "tomcat-catalina-ant", "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-ant@10.1.16", "type": "library", "group": "org.apache.tomcat", "version": "10.1.16" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-23672", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ant@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:615f3593-9695-50ae-9b65-f06f2b1a46e4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-23672 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ant." } }, { "id": "CVE-2024-24549", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ant@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:9aae389c-3704-57fc-b1e8-bee01867d57d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-24549 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ant." } }, { "id": "CVE-2024-34750", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ant@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:3c612b82-b0cd-5c34-9e31-f9aaba5f9365", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34750 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ant." } }, { "id": "CVE-2024-38286", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ant@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:018fcb84-050e-5166-a024-71a50fdedb2b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38286 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ant." } }, { "id": "CVE-2024-50379", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ant@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:87cec575-6222-5d3c-977b-c32416ce8d2a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-50379 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ant." } }, { "id": "CVE-2024-52316", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ant@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:68e58004-cbbf-52d0-b2f3-665d9740434e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-52316 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ant." } }, { "id": "CVE-2024-54677", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ant@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:3318ccd4-8977-5f61-ada6-591594bc8fd2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-54677 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ant." } }, { "id": "CVE-2024-56337", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ant@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:cc0ff3dc-34d0-5a0e-ab53-2ab22bce52d4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-56337 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ant." } }, { "id": "CVE-2025-24813", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ant@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:ba742fdd-ab0b-59e3-91cc-4fb0aacd1579", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-24813 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ant." } }, { "id": "CVE-2025-31650", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ant@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:351cfdba-be2e-54bf-a40d-f1eef966332b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31650 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ant." } }, { "id": "CVE-2025-31651", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ant@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:75c4a1aa-4415-5c80-be58-aa0a3c3b1773", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31651 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ant." } }, { "id": "CVE-2025-46701", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ant@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:dc58c25a-b517-5f15-87bb-4b626e7b5013", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-46701 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ant." } }, { "id": "CVE-2025-48988", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ant@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:905138e4-37cc-5ec0-969c-d480da673616", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-48988 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ant." } }, { "id": "CVE-2025-48989", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ant@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:b1124ac2-04d0-5698-bf81-da09295e1663", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48989 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ant." } }, { "id": "CVE-2025-49124", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ant@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:6c482579-0e9e-5555-ba97-84cb04ad2976", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49124 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ant." } }, { "id": "CVE-2025-49125", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ant@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:ed249e65-cb36-52f3-a718-2d8e8e80424f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49125 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ant." } }, { "id": "CVE-2025-52520", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ant@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:878bb4ad-286a-53b3-8277-96d1101a3525", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-52520 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ant." } }, { "id": "CVE-2025-53506", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ant@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:e179b5d4-f9e7-54d5-8299-97a8d457611c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-53506 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ant." } }, { "id": "CVE-2025-55668", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ant@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:8af96fef-f4cf-534a-afd7-8f9f35fd65d6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55668 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ant." } }, { "id": "CVE-2025-55752", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ant@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:94827cc0-9940-5473-8b09-3d64285d4992", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-55752 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ant. Version 10.1.16 is NOT vulnerable to CVE-2025-55752. The vulnerable code pattern (normalizing before decoding in RewriteValve) was introduced later in version 10.1.40. Version 10.1.16 uses a different code structure that does not call URLDecoder.decode after RequestUtil.normalize, thus the vulnerability is not present. The CVE advisory's version range \"10.1.0-M1 through 10.1.44\" is over-broad; only versions 10.1.40-10.1.44 contain the vulnerable pattern.", "justification": "code_not_present" } }, { "id": "CVE-2025-55754", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ant@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:4ffd901a-8059-5718-bb7d-032d202ebb87", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55754 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ant." } }, { "id": "CVE-2025-61795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ant@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:732ea59f-32c8-5420-9e21-f2ed92c59659", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-61795 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ant." } }, { "id": "CVE-2025-66614", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ant@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:d2810172-846a-5148-8a28-5e08ebdc437e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66614 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ant." } }, { "id": "CVE-2026-24733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ant@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:587a2be5-e69e-5ac2-9c44-dd365de001a9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24733 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ant." } }, { "id": "CVE-2026-24734", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ant@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:b1c87e42-336f-508d-b9c6-f9ac3d3bdee4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24734 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ant." } }, { "id": "CVE-2026-24880", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ant@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:cdc8206b-3d62-528d-97f1-b4d2dce3ddef", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24880 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ant." } }, { "id": "CVE-2026-25854", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ant@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:f9b306e6-0bdf-5ff9-b585-e8d9b326974c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25854 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ant." } }, { "id": "CVE-2026-29145", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ant@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:33247305-b15c-56c1-8021-b10f5f099523", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29145 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ant." } }, { "id": "CVE-2026-29146", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ant@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:84275de0-dd39-58f7-baf3-e31324e480fe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29146 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ant." } }, { "id": "CVE-2026-32990", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ant@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:d3daa80a-9551-58a4-a995-846bb926be72", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-32990 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ant. not_affected \u2014 Apache Tomcat 10.1.16 is not affected by CVE-2026-32990. The vulnerability exists in the checkSni() method's incomplete fix for CVE-2025-66614, affecting versions 10.1.50-10.1.52. Version 10.1.16 predates the introduction of the strict SNI validation feature entirely - the checkSni method, strictSni field, and protocolHostName parameter do not exist in this version. The vulnerability pattern (c...", "justification": "code_not_present" } }, { "id": "CVE-2026-34483", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ant@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:d4948410-9266-59e6-9a79-9983921b91cb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34483 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ant." } }, { "id": "CVE-2026-34487", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ant@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:ed7898d1-c716-5665-99dc-b8d3d4926c89", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34487 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ant." } }, { "id": "CVE-2026-41284", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ant@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:60f49216-100f-5c98-b93e-186949ab3615", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41284 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ant." } }, { "id": "CVE-2026-41293", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ant@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:b8cd0850-0cd4-5058-bd69-fa50198d8488", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41293 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ant." } }, { "id": "CVE-2026-42498", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ant@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:9dde3ce7-d8e3-570e-a058-e6e11407c126", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42498 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ant." } }, { "id": "CVE-2026-43512", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ant@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:755265db-0c11-5ac3-b843-3a44d2122da4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43512 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ant." } }, { "id": "CVE-2026-43513", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ant@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:fc496638-0dbd-5bcb-b2a2-8e681d81a981", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43513 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ant." } }, { "id": "CVE-2026-43514", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ant@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:ab8f4888-e47e-5ca8-82cc-d78ccfb2db1c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43514 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ant." } }, { "id": "CVE-2026-43515", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ant@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:4f3b87e9-21e3-5483-be03-4dc81c2033f3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-43515 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ant." } }, { "id": "CVE-2026-53434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ant@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:8ec1861b-97aa-5653-9e60-4e3d7e3b6f57", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53434 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ant." } }, { "id": "CVE-2026-65182", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ant@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:04d60cb2-e37b-580d-bb79-c7e6f48ed543", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65182 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ant." } }, { "id": "CVE-2026-65905", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ant@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:d753f514-919d-5014-b1e4-d7984f880429", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65905 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ant." } }, { "id": "CVE-2026-68525", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ant@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:b7524191-5030-5143-8fb3-f74a73c742ac", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68525 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ant." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ant@10.1.16-tuxcare.1" } ] }