{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:764cdf5e-268d-5580-b0a6-7f146b9650e3", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat-coyote", "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1", "version": "10.1.16-tuxcare.1", "pedigree": { "ancestors": [ { "name": "tomcat-coyote", "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16", "type": "library", "group": "org.apache.tomcat", "version": "10.1.16" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-23672", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:a8ea9f61-92ae-5188-a529-4d7d01ed2b72", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-23672 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-24549", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:7abd38d0-ccdb-52ea-99af-e0c347fd3d28", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-24549 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-34750", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:0e62153c-4810-5df7-af04-5a44e0e0feb3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34750 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-38286", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:690836fe-94ea-5b6c-8327-babde83cd06e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38286 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-50379", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:842994aa-e011-5b54-8fe8-31e5bcf2e41f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-50379 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-52316", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:6a36f762-2d75-5763-93cd-554e2c46306b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-52316 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-54677", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:66bfb174-8a3b-54d1-80cd-69c119b3e961", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-54677 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-56337", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:6fd9c49d-af8b-520c-9acb-b6aab0dd4e8b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-56337 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2025-24813", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:3b1fdc37-0329-5eb6-a747-d6b497acc80d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-24813 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2025-31650", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:77059ded-bbd8-5e72-b9c7-e2fabe3a4f58", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31650 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2025-31651", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:198972cc-0aff-592a-9f75-9cf46913c722", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31651 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2025-46701", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:43b82d3a-8bfd-5379-99d4-eef24da0adb8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-46701 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2025-48988", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:eb059600-400b-5b8a-8947-0e7f11fad3fd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-48988 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2025-48989", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:bcaefff3-4311-5734-914f-02818682b20d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48989 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2025-49124", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:f2b68cbf-ec97-5caa-a40d-8101000d2a77", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49124 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2025-49125", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:8b4533fa-cd79-5909-abdf-ba55a3ec9a4b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49125 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2025-52520", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:ffbdfb20-ea1a-5ccf-8557-929cb423f273", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-52520 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2025-53506", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:ce1fc3d9-fc50-503c-b539-da0bdd8b8fdf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-53506 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2025-55668", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:f349e03a-cdb1-571d-a95e-0d1a05454a90", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55668 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2025-55752", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:ba73027f-c418-548b-9498-e5b88bceb515", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-55752 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-coyote. Version 10.1.16 is NOT vulnerable to CVE-2025-55752. The vulnerable code pattern (normalizing before decoding in RewriteValve) was introduced later in version 10.1.40. Version 10.1.16 uses a different code structure that does not call URLDecoder.decode after RequestUtil.normalize, thus the vulnerability is not present. The CVE advisory's version range \"10.1.0-M1 through 10.1.44\" is over-broad; only versions 10.1.40-10.1.44 contain the vulnerable pattern.", "justification": "code_not_present" } }, { "id": "CVE-2025-55754", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:45c3130d-8dde-5a95-b616-fd945d053439", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55754 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2025-61795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:7147623a-3cc8-5fc1-8cb6-d364f464456d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-61795 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2025-66614", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:47444ae8-8aa0-5751-aca0-7a5843353c56", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66614 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-24733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:ebf0a1b0-5280-5f53-8f12-3c6de4e6039e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24733 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-24734", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:ad182c19-93b7-5be1-861b-15c53ced05d1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24734 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-24880", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:a6264111-6e9a-59aa-bbb0-ed3276d45c4a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24880 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-25854", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:88e82016-e590-58b3-94a4-cab01947da81", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25854 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-29145", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:fa44161d-9bd6-50c8-8005-9fcad34e252f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29145 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-29146", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:fc1ca989-5cb5-5043-bc19-3f336223464e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29146 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-32990", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:fd5cb131-ffd3-5fca-84e3-cd28e43a41f6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-32990 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 Apache Tomcat 10.1.16 is not affected by CVE-2026-32990. The vulnerability exists in the checkSni() method's incomplete fix for CVE-2025-66614, affecting versions 10.1.50-10.1.52. Version 10.1.16 predates the introduction of the strict SNI validation feature entirely - the checkSni method, strictSni field, and protocolHostName parameter do not exist in this version. The vulnerability pattern (c...", "justification": "code_not_present" } }, { "id": "CVE-2026-34483", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:54fe235f-a795-5f60-b037-7ae6c040ce6a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34483 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-34487", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:69d050dc-78f8-5a40-8551-0eb4f44e3bcf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34487 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-41284", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:43579dcd-683a-5d98-adec-d1082b910a9d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41284 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-41293", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:851d2f2c-0540-5195-ba3b-febb01980c08", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41293 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-42498", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:be12e008-1121-5dcd-a366-a20f41a658db", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42498 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-43512", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:f6e4371d-9b97-5872-8dc0-3e3d1f5506fa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43512 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-43513", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:dc3d3c89-124c-55e7-aca8-82c9010a6c0f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43513 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-43514", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:e92d1c3c-a81d-5387-8505-6723d673face", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43514 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-43515", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:b2383100-5d4b-5ff1-ac36-04ad5e0b16a6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-43515 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-53434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:0d825f04-dbad-51cf-bbc5-93e584d48dbb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53434 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-65182", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:49a1a8f8-feee-5971-ab03-14552064b642", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65182 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-65905", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:a231950d-81c6-50bd-b15d-e65f5f121eef", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65905 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-68525", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:0a459ac3-2694-5e79-a283-9cd3e912776e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68525 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ] }