{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:e29d4f01-9a85-5abc-90de-5553e09eeae1", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat-catalina", "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.1", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.1", "version": "10.1.16-tuxcare.1", "pedigree": { "ancestors": [ { "name": "tomcat-catalina", "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16", "type": "library", "group": "org.apache.tomcat", "version": "10.1.16" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-23672", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:4d996954-c72f-5f9f-b257-a7d77c1691a4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-23672 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2024-24549", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:afa9bed3-cb5a-53d5-9314-e7ea8f21f868", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-24549 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2024-34750", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:71823a2e-f90a-5b69-bd52-8a2199f612d9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34750 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2024-38286", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:c36cda75-8c5c-50e9-8f3a-a3afa6987801", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38286 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2024-50379", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:4701fa05-b6c6-5f58-bf43-57efc193b283", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-50379 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2024-52316", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:9a5fd74b-c658-5209-8365-859f7fca6fb2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-52316 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2024-54677", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:997f7866-e0b1-5922-b915-23390c7aa029", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-54677 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2024-56337", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:9d184083-3e0d-53ea-b059-7aa34b2a8ba4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-56337 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-24813", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:e9f8a108-a7e4-5a4c-9ba2-8d6318d3ca60", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-24813 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-31650", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:1e6af6c8-e79d-5129-bcb9-7a44164c0184", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31650 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-31651", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:35bc9c3b-b41f-5a38-9871-46caddf12e35", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31651 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-46701", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:ad2eddb5-1061-5b5a-b686-2de016ee1b72", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-46701 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-48988", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:a7eeae05-9932-5b4b-8e86-1c32c0eff4ff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-48988 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-48989", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:3d5eb6c4-6359-5472-896e-22c9b6ae38eb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48989 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-49124", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:16909252-ab9c-5c6f-a533-5f108b776d0f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49124 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-49125", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:42a44cd3-cc44-55bd-9eb7-c5123bb882a8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49125 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-52520", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:2eadedb6-4eeb-5a44-8ece-671ff16d65c1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-52520 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-53506", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:df2fcd9c-b940-5f5a-9a2f-166d9dae155a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-53506 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-55668", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:90a5622d-9b51-54af-a6dc-563545154c0f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55668 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-55752", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:52a0a623-41e5-51d0-b81e-756812709bc9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-55752 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina. Version 10.1.16 is NOT vulnerable to CVE-2025-55752. The vulnerable code pattern (normalizing before decoding in RewriteValve) was introduced later in version 10.1.40. Version 10.1.16 uses a different code structure that does not call URLDecoder.decode after RequestUtil.normalize, thus the vulnerability is not present. The CVE advisory's version range \"10.1.0-M1 through 10.1.44\" is over-broad; only versions 10.1.40-10.1.44 contain the vulnerable pattern.", "justification": "code_not_present" } }, { "id": "CVE-2025-55754", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:8518ff7a-48ba-5c4e-966a-6b0f00a5d27e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55754 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-61795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:65317797-87d4-5029-8632-fcbca6ae688c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-61795 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-66614", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:ed940456-c21d-5f6f-91ad-980d1fe6f6c7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66614 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-24733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:9aeca8e7-2b19-55a8-89ca-816c6b1fee3b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24733 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-24734", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:4d64be84-0145-5376-88f6-618a85a5ecc5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24734 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-24880", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:ae20cd7d-8284-5f48-b743-45493acad2ce", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24880 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-25854", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:b45aacda-04c2-5ee8-979e-6b7af2465125", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25854 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-29145", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:84951665-612d-511a-8236-0b6ce432af3e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29145 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-29146", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:7202ace8-ffd7-5495-ba10-56df55e9cc98", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29146 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-32990", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:1b776ad8-873e-55c8-b424-92a2d02d3a11", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-32990 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina. not_affected \u2014 Apache Tomcat 10.1.16 is not affected by CVE-2026-32990. The vulnerability exists in the checkSni() method's incomplete fix for CVE-2025-66614, affecting versions 10.1.50-10.1.52. Version 10.1.16 predates the introduction of the strict SNI validation feature entirely - the checkSni method, strictSni field, and protocolHostName parameter do not exist in this version. The vulnerability pattern (c...", "justification": "code_not_present" } }, { "id": "CVE-2026-34483", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:746d14ff-572b-5291-b99e-ed2e288254f8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34483 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-34487", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:60c152d8-7c86-57ae-85bc-956e2c56ea12", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34487 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-41284", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:841582e0-6f8e-5735-a755-68e9cef1295b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41284 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-41293", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:656f146b-578e-5c72-8321-0f0bf3047d4b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41293 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-42498", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:683f77cb-abe6-5129-a042-6406f75c7ac1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42498 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-43512", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:560b7f9a-b50d-51da-86f5-e344f021b3a1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43512 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-43513", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:3c595e47-9f0f-5847-9424-d9767bbffe25", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43513 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-43514", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:51a0afa6-f07a-594f-bbbe-13f55e6990fe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43514 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-43515", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:7dfde86e-a2db-5a74-a107-e5fffdc35ac1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-43515 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-53434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:e9b48450-c421-55c1-b26c-c8ec183dd307", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53434 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-65182", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:b7206207-a033-59d1-854c-6404141f600f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65182 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-65905", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:0836199b-233b-5816-927d-0391d138cf0a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65905 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-68525", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:e5863f3b-5581-5980-a0a1-e1116de0d73e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68525 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.1" } ] }