{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:f34cab0b-1c5e-5115-80f7-cc8c9495bb2f", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat-coyote", "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1", "version": "9.0.13-tuxcare.1", "pedigree": { "ancestors": [ { "name": "tomcat-coyote", "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13", "type": "library", "group": "org.apache.tomcat", "version": "9.0.13" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2019-0199", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1" } ], "bom-ref": "urn:uuid:c8442e9b-ce7f-54cd-aace-d38264f3b36c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-0199 affects version 9.0.13-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2019-0221", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1" } ], "bom-ref": "urn:uuid:7de806b7-2977-5bf9-bbc7-4ce4628f8d41", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-0221 is fixed in version 9.0.13-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2019-0232", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1" } ], "bom-ref": "urn:uuid:d343f888-eb0f-562e-8ec4-53f11dcfabe7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-0232 affects version 9.0.13-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2019-10072", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1" } ], "bom-ref": "urn:uuid:8b01f558-3587-587e-82d8-08342e8205a9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10072 affects version 9.0.13-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2019-12418", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1" } ], "bom-ref": "urn:uuid:ed974f30-f55c-5769-bb78-ba88c577d3f5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-12418 is fixed in version 9.0.13-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2019-17563", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1" } ], "bom-ref": "urn:uuid:e640b647-25db-55ae-b044-68751224c884", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17563 affects version 9.0.13-tuxcare.1 of org.apache.tomcat:tomcat-coyote, and is fixed in 9.0.13-tuxcare.2." } }, { "id": "CVE-2020-11996", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1" } ], "bom-ref": "urn:uuid:9452ce10-0154-559b-a95a-33660a58818b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-11996 affects version 9.0.13-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2020-13934", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1" } ], "bom-ref": "urn:uuid:48bcb7ed-6483-5f21-94ef-3f9aec22af8a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-13934 affects version 9.0.13-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2020-13935", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1" } ], "bom-ref": "urn:uuid:87a00afe-adfc-5375-9eb2-6832acea3583", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-13935 affects version 9.0.13-tuxcare.1 of org.apache.tomcat:tomcat-coyote, and is fixed in 9.0.13-tuxcare.2." } }, { "id": "CVE-2020-13943", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1" } ], "bom-ref": "urn:uuid:765c6f40-7495-5b44-8272-02f8b3520110", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-13943 affects version 9.0.13-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2020-17527", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1" } ], "bom-ref": "urn:uuid:fdec506b-b929-5b6a-b404-4696a47af54c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-17527 affects version 9.0.13-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2020-1935", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1" } ], "bom-ref": "urn:uuid:523d54ff-8253-5f27-b340-5cef3feb5fe6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-1935 affects version 9.0.13-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2020-1938", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1" } ], "bom-ref": "urn:uuid:78161abf-fafd-5172-ba12-988bcd6282a9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-1938 is fixed in version 9.0.13-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2020-8022", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1" } ], "bom-ref": "urn:uuid:72109761-a1e6-537a-80b0-33173d698941", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2020-8022 is a false positive for org.apache.tomcat:tomcat-coyote 9.0.13-tuxcare.1." } }, { "id": "CVE-2020-9484", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1" } ], "bom-ref": "urn:uuid:9f774026-3958-5e56-af7d-181afc1dd26f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-9484 is fixed in version 9.0.13-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2021-24122", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1" } ], "bom-ref": "urn:uuid:7a7c70c3-59cf-596a-bf56-95dd0ea92686", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-24122 is fixed in version 9.0.13-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2021-25122", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1" } ], "bom-ref": "urn:uuid:bf73b1c0-0493-545c-9a44-d85d67ec81e9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-25122 affects version 9.0.13-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2021-25329", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1" } ], "bom-ref": "urn:uuid:662429b7-5a34-5c65-9d96-2b8c70ce6c1b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-25329 affects version 9.0.13-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2021-30639", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1" } ], "bom-ref": "urn:uuid:845223e9-92ce-516f-8051-ec1332aae786", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-30639 does not affect version 9.0.13-tuxcare.1 of org.apache.tomcat:tomcat-coyote. CVE-2021-30639 affects Apache Tomcat versions where the errorException field was introduced as part of non-blocking I/O error handling improvements: 10.0.3-10.0.4, 9.0.44, and 8.5.64. The target version 9.0.13 predates the introduction of the errorException field (which first appeared in 9.0.44 for the 9.0.x series) and therefore cannot exhibit the vulnerability. The vulnerability pattern - failure to clear errorException in the recycle() method causing subsequent requests to fail - is absent because the errorException field does not exist in this version.", "justification": "code_not_present" } }, { "id": "CVE-2021-30640", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1" } ], "bom-ref": "urn:uuid:126c6238-8f08-5787-940e-8dbbb81aae71", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-30640 affects version 9.0.13-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2021-33037", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1" } ], "bom-ref": "urn:uuid:2283df72-97f4-5d2d-9a52-96de5a7e0871", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-33037 is fixed in version 9.0.13-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2021-41079", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1" } ], "bom-ref": "urn:uuid:e90093ab-d930-55c2-97bd-d6e153da41a7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-41079 affects version 9.0.13-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2021-42340", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1" } ], "bom-ref": "urn:uuid:02f66343-70e8-510b-a878-fc13024f6a93", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-42340 does not affect version 9.0.13-tuxcare.1 of org.apache.tomcat:tomcat-coyote. Tomcat 9.0.13 is NOT AFFECTED by CVE-2021-42340. The vulnerability was introduced by bug 63362 (committed 2020-10-15), which added metric collection infrastructure (UpgradeInfo/UpgradeGroupInfo classes) for HTTP upgrade connections. These classes do not exist in 9.0.13 (released 2018-11-02), therefore the memory leak cannot occur. The CVE's stated version range (9.0.40 to 9.0.53) correctly excludes 9.0.13, which predates the vulnerability-introducing code by nearly 2 years.", "justification": "code_not_present" } }, { "id": "CVE-2021-43980", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1" } ], "bom-ref": "urn:uuid:5bc3c2d6-db8e-5bf4-bf9a-1f8d3c4d7292", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-43980 does not affect version 9.0.13-tuxcare.1 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 Version 9.0.13 is not affected by CVE-2021-43980. The vulnerability exists in the `currentProcessor` field mechanism introduced in Tomcat 9.0.28 (October 2019). Version 9.0.13 uses an older architecture where processors are stored in a `connections` ConcurrentHashMap without the `currentProcessor` field. The patch specifically addresses race conditions in the currentProcessor field by changing ...", "justification": "code_not_present" } }, { "id": "CVE-2022-23181", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1" } ], "bom-ref": "urn:uuid:70f9c4c4-5895-5ead-8dc7-66f75fdc68b9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-23181 affects version 9.0.13-tuxcare.1 of org.apache.tomcat:tomcat-coyote, and is fixed in 9.0.13-tuxcare.2." } }, { "id": "CVE-2022-25762", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1" } ], "bom-ref": "urn:uuid:c38f245d-6b76-5d3a-bc5e-469fd3108577", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-25762 affects version 9.0.13-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2022-29885", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1" } ], "bom-ref": "urn:uuid:5f7df11a-aff0-5103-82ba-341e05cb7e42", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-29885 does not affect version 9.0.13-tuxcare.1 of org.apache.tomcat:tomcat-coyote. The target Apache Tomcat 9.0.13 is NOT AFFECTED by CVE-2022-29885. The vulnerability concerns misleading documentation that suggested EncryptInterceptor enables safe Tomcat clustering on untrusted networks (when it only provides confidentiality/integrity, not DoS protection). However, version 9.0.13 (released 2018-11-02) never contained this misleading documentation. The vulnerable documentation pattern was added to upstream Tomcat on 2019-01-30 (3 months after 9.0.13's release) and first appeared in version ~9.0.16. The target's documentation correctly states that clustering requires trusted networks and lists only appropriate security options (private LAN, VPN, IPSEC) without suggesting EncryptInterceptor as a solution for untrusted networks. The CVE metadata stating \"9.0.13 to 9.0.62\" is technically inaccurate regarding the actual 9.0.13 release.", "justification": "code_not_present" } }, { "id": "CVE-2022-34305", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1" } ], "bom-ref": "urn:uuid:0ad439c4-ded8-5f54-96d0-a1b52adea907", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-34305 does not affect version 9.0.13-tuxcare.1 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 Apache Tomcat 9.0.13 is not affected by CVE-2022-34305. The vulnerable code pattern (displaying session attributes and Principal attributes without HTML filtering) does not exist in this version. The affected feature was introduced in Tomcat 9.0.30+, and version 9.0.13 predates this functionality. The file webapps/examples/jsp/security/protected/index.jsp in 9.0.13 is only 82 lines and displays...", "justification": "code_not_present" } }, { "id": "CVE-2022-42252", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1" } ], "bom-ref": "urn:uuid:df4c17a1-cc1a-5225-880a-c7abcec17691", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-42252 affects version 9.0.13-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2022-45143", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1" } ], "bom-ref": "urn:uuid:51aeffc5-ebda-53e8-878f-5c758d1bd3f8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-45143 does not affect version 9.0.13-tuxcare.1 of org.apache.tomcat:tomcat-coyote. Apache Tomcat 9.0.13 is not affected by CVE-2022-45143. The vulnerability concerns JsonErrorReportValve, a component that was introduced in Tomcat 9.0.40. Version 9.0.13 predates this introduction and does not contain the vulnerable class or any JSON error reporting functionality.", "justification": "code_not_present" } }, { "id": "CVE-2023-24998", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1" } ], "bom-ref": "urn:uuid:cdf644ff-299c-5128-8b3b-d96ab7c2f0ff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-24998 affects version 9.0.13-tuxcare.1 of org.apache.tomcat:tomcat-coyote, and is fixed in 9.0.13-tuxcare.2." } }, { "id": "CVE-2023-28708", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1" } ], "bom-ref": "urn:uuid:964ef97b-d16c-5355-9962-f49fec41cff2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-28708 is fixed in version 9.0.13-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-41080", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1" } ], "bom-ref": "urn:uuid:dec356f2-fb19-50fe-a006-c2186ea3d1b6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-41080 affects version 9.0.13-tuxcare.1 of org.apache.tomcat:tomcat-coyote, and is fixed in 9.0.13-tuxcare.2." } }, { "id": "CVE-2023-42795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1" } ], "bom-ref": "urn:uuid:39d1b92e-6440-5a12-a560-2445f754fd3d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-42795 affects version 9.0.13-tuxcare.1 of org.apache.tomcat:tomcat-coyote, and is fixed in 9.0.13-tuxcare.2." } }, { "id": "CVE-2023-44487", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1" } ], "bom-ref": "urn:uuid:d7de0cec-e807-5129-ae6e-55e82f47354c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-44487 affects version 9.0.13-tuxcare.1 of org.apache.tomcat:tomcat-coyote, and is fixed in 9.0.13-tuxcare.2." } }, { "id": "CVE-2023-45648", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1" } ], "bom-ref": "urn:uuid:b4d39fb2-7ef7-5fb6-ab6e-5245a314a998", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-45648 affects version 9.0.13-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-46589", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1" } ], "bom-ref": "urn:uuid:14a8c5b2-518a-50d9-a3c3-da39a839234c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-46589 affects version 9.0.13-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-21733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1" } ], "bom-ref": "urn:uuid:4e695ca5-f53b-5452-814d-fae251839542", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-21733 affects version 9.0.13-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-23672", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1" } ], "bom-ref": "urn:uuid:c5c91ec0-0d64-5511-82de-cc13303cc6c4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-23672 affects version 9.0.13-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-24549", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1" } ], "bom-ref": "urn:uuid:eb2e3d7b-c106-5a0c-851f-6e76b8b316d1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-24549 affects version 9.0.13-tuxcare.1 of org.apache.tomcat:tomcat-coyote, and is fixed in 9.0.13-tuxcare.2." } }, { "id": "CVE-2024-34750", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1" } ], "bom-ref": "urn:uuid:e8b7c470-11b7-5696-8ce9-248c3a7ff2a1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-34750 affects version 9.0.13-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-38286", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1" } ], "bom-ref": "urn:uuid:b2fd831e-3b8a-5ad6-9885-2effb6bc31f5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38286 affects version 9.0.13-tuxcare.1 of org.apache.tomcat:tomcat-coyote, and is fixed in 9.0.13-tuxcare.2." } }, { "id": "CVE-2024-50379", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1" } ], "bom-ref": "urn:uuid:dc5c8cb7-387f-5b8c-bea1-d1de016530cd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-50379 affects version 9.0.13-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-52316", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1" } ], "bom-ref": "urn:uuid:97827adb-b5ba-57c9-9c94-f93b937db682", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-52316 affects version 9.0.13-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-54677", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1" } ], "bom-ref": "urn:uuid:c68c50f2-894a-5c56-a40e-54d9b2b050ac", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-54677 affects version 9.0.13-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-56337", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1" } ], "bom-ref": "urn:uuid:899bb432-08ab-5d31-a9ed-24b18db4cdaf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-56337 affects version 9.0.13-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2025-24813", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1" } ], "bom-ref": "urn:uuid:afd5f6a2-95d9-54ed-9a70-72d39221e673", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-24813 affects version 9.0.13-tuxcare.1 of org.apache.tomcat:tomcat-coyote, and is fixed in 9.0.13-tuxcare.2." } }, { "id": "CVE-2025-31650", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1" } ], "bom-ref": "urn:uuid:0e29bbac-bd3d-5ea6-912a-6e977507ef63", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-31650 does not affect version 9.0.13-tuxcare.1 of org.apache.tomcat:tomcat-coyote. Apache Tomcat 9.0.13 is not affected by CVE-2025-31650. The vulnerability requires RFC 9218 Extensible Priorities implementation (PRIORITY_UPDATE frames and Priority header parsing via Priority.parsePriority() method), which does not exist in version 9.0.13. The target version only implements the original HTTP/2 PRIORITY frame mechanism (RFC 7540, frame type 2), which is unrelated to this CVE. Exhaustive code analysis confirmed zero RFC 9218-related code present: no PRIORITY_UPDATE frame type, no readPriorityUpdateFrame() method, no Priority.parsePriority() parser class, and no priority header case in Stream.emitHeader(). The CVE's affected version range starts at 9.0.76, where RFC 9218 support was introduced; version 9.0.13 predates this feature.", "justification": "code_not_present" } }, { "id": "CVE-2025-31651", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1" } ], "bom-ref": "urn:uuid:92f2c2f7-cae5-510e-97a4-71844559bac2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31651 affects version 9.0.13-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2025-46701", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1" } ], "bom-ref": "urn:uuid:18ed6371-ad0f-5b09-9aa2-33af0ec3bf83", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-46701 affects version 9.0.13-tuxcare.1 of org.apache.tomcat:tomcat-coyote, and is fixed in 9.0.13-tuxcare.2." } }, { "id": "CVE-2025-48988", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1" } ], "bom-ref": "urn:uuid:244f0121-cdf9-58c7-83ed-dfcff9a594fe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-48988 affects version 9.0.13-tuxcare.1 of org.apache.tomcat:tomcat-coyote, and is fixed in 9.0.13-tuxcare.2." } }, { "id": "CVE-2025-48989", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1" } ], "bom-ref": "urn:uuid:b3452388-c4ff-5df2-a8d1-69463d5414af", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48989 is fixed in version 9.0.13-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2025-49125", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1" } ], "bom-ref": "urn:uuid:46ccb87f-9bee-5874-b6e7-ea3ade332aa6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49125 affects version 9.0.13-tuxcare.1 of org.apache.tomcat:tomcat-coyote, and is fixed in 9.0.13-tuxcare.2." } }, { "id": "CVE-2025-52434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1" } ], "bom-ref": "urn:uuid:37dfb447-586a-5de9-83f9-b20b44779880", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-52434 affects version 9.0.13-tuxcare.1 of org.apache.tomcat:tomcat-coyote, and is fixed in 9.0.13-tuxcare.2." } }, { "id": "CVE-2025-52520", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1" } ], "bom-ref": "urn:uuid:3c82763a-2850-5216-be55-339b13293184", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-52520 affects version 9.0.13-tuxcare.1 of org.apache.tomcat:tomcat-coyote, and is fixed in 9.0.13-tuxcare.2." } }, { "id": "CVE-2025-53506", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1" } ], "bom-ref": "urn:uuid:040f9c61-4189-5f55-b184-bc869977522e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-53506 affects version 9.0.13-tuxcare.1 of org.apache.tomcat:tomcat-coyote, and is fixed in 9.0.13-tuxcare.2." } }, { "id": "CVE-2025-55668", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1" } ], "bom-ref": "urn:uuid:ec29f1a2-966e-52ef-9583-d0c8e0032b7b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55668 affects version 9.0.13-tuxcare.1 of org.apache.tomcat:tomcat-coyote, and is fixed in 9.0.13-tuxcare.2." } }, { "id": "CVE-2025-55752", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1" } ], "bom-ref": "urn:uuid:bb54c206-88fb-529f-8f60-ad9570d90422", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55752 affects version 9.0.13-tuxcare.1 of org.apache.tomcat:tomcat-coyote, and is fixed in 9.0.13-tuxcare.2." } }, { "id": "CVE-2025-61795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1" } ], "bom-ref": "urn:uuid:5bb98584-32d8-50f5-a958-60b06d78f5e3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-61795 affects version 9.0.13-tuxcare.1 of org.apache.tomcat:tomcat-coyote, and is fixed in 9.0.13-tuxcare.2." } }, { "id": "CVE-2025-66614", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1" } ], "bom-ref": "urn:uuid:119aeefe-d4e3-5bdc-a43b-8ac8f55c0ccf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66614 affects version 9.0.13-tuxcare.1 of org.apache.tomcat:tomcat-coyote, and is fixed in 9.0.13-tuxcare.2." } }, { "id": "CVE-2026-24733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1" } ], "bom-ref": "urn:uuid:7006863e-3b45-5632-b232-51e45b4aec1c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24733 affects version 9.0.13-tuxcare.1 of org.apache.tomcat:tomcat-coyote, and is fixed in 9.0.13-tuxcare.2." } }, { "id": "CVE-2026-24880", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1" } ], "bom-ref": "urn:uuid:177afe31-b052-5a91-a350-8b04e7af822c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24880 affects version 9.0.13-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-25854", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1" } ], "bom-ref": "urn:uuid:4a192405-4966-5f35-a361-a905ca5c68bf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-25854 affects version 9.0.13-tuxcare.1 of org.apache.tomcat:tomcat-coyote, and is fixed in 9.0.13-tuxcare.2." } }, { "id": "CVE-2026-29146", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1" } ], "bom-ref": "urn:uuid:4579ea8a-86aa-5ba2-b893-d7baba6b05bf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29146 is fixed in version 9.0.13-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-32990", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1" } ], "bom-ref": "urn:uuid:4d3ec0c7-cc2d-556a-b056-b502585b2073", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-32990 affects version 9.0.13-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-34487", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1" } ], "bom-ref": "urn:uuid:3f03293a-331f-5c17-a487-d950a96895f0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34487 affects version 9.0.13-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-41284", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1" } ], "bom-ref": "urn:uuid:e3e8ad08-ef98-591f-94dc-f6b7833f384b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41284 affects version 9.0.13-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-41293", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1" } ], "bom-ref": "urn:uuid:9ad1be7c-378d-524c-9dfe-0ff86e19dce3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41293 affects version 9.0.13-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-42498", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1" } ], "bom-ref": "urn:uuid:e30001bd-d496-5062-96ba-6b6eaef2b10e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42498 affects version 9.0.13-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-43512", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1" } ], "bom-ref": "urn:uuid:35f0bad8-d1e2-54ad-82f9-fc54c0c9eb66", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43512 affects version 9.0.13-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-43513", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1" } ], "bom-ref": "urn:uuid:8e238653-12b7-5055-b6a0-c66fea4e2bc2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43513 affects version 9.0.13-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-43514", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1" } ], "bom-ref": "urn:uuid:f96fbeac-ff0e-50fb-b35d-797a720a26ae", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43514 affects version 9.0.13-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-43515", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1" } ], "bom-ref": "urn:uuid:019dd710-36cb-571c-8305-bccb18f25896", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43515 affects version 9.0.13-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-65182", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1" } ], "bom-ref": "urn:uuid:a58d83aa-c921-582a-88de-4392e63b073e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65182 affects version 9.0.13-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-65905", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1" } ], "bom-ref": "urn:uuid:17005bc6-8da4-5aea-bd1e-359deb5ffdd3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65905 affects version 9.0.13-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-68525", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1" } ], "bom-ref": "urn:uuid:8c0cb414-287f-55bd-864c-d0ee3abfb1ef", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-68525 affects version 9.0.13-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "GHSA-r53m-pfr5-7v87", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1" } ], "bom-ref": "urn:uuid:652a9888-1694-5fc3-9bbc-4e5a09d2dd0f", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-r53m-pfr5-7v87 is a false positive for org.apache.tomcat:tomcat-coyote 9.0.13-tuxcare.1." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.1" } ] }