{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:26dd7fb4-6be0-5e7c-8ce2-8c3ee712fce3", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat-dbcp", "purl": "pkg:maven/org.apache.tomcat/tomcat-dbcp@10.1.16-tuxcare.1", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-dbcp@10.1.16-tuxcare.1", "version": "10.1.16-tuxcare.1", "pedigree": { "ancestors": [ { "name": "tomcat-dbcp", "purl": "pkg:maven/org.apache.tomcat/tomcat-dbcp@10.1.16", "type": "library", "group": "org.apache.tomcat", "version": "10.1.16" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-23672", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-dbcp@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:1d792bef-a2f2-5243-b798-394935acca57", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-23672 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-dbcp." } }, { "id": "CVE-2024-24549", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-dbcp@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:3db4a0c4-619b-51d1-bf3f-e6cb8e596aa1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-24549 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-dbcp." } }, { "id": "CVE-2024-34750", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-dbcp@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:84c9ced7-253e-5667-a0c0-1ef559c02315", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34750 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-dbcp." } }, { "id": "CVE-2024-38286", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-dbcp@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:e6a63f9d-64bf-5537-8f7e-0e9223d68bd7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38286 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-dbcp." } }, { "id": "CVE-2024-50379", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-dbcp@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:568f8a3a-54f2-5b9a-84d2-7b9236dd66ab", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-50379 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-dbcp." } }, { "id": "CVE-2024-52316", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-dbcp@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:ee73d470-47ca-5fc7-a388-21a9ab4b926d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-52316 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-dbcp." } }, { "id": "CVE-2024-54677", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-dbcp@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:e4e00f92-71bf-565f-99cd-0959100a36dc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-54677 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-dbcp." } }, { "id": "CVE-2024-56337", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-dbcp@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:a63e78c1-d677-53c0-980e-9ec549aa8f43", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-56337 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-dbcp." } }, { "id": "CVE-2025-24813", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-dbcp@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:7f1e861d-23d1-5d84-b4d1-2d2b73a7f1f9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-24813 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-dbcp." } }, { "id": "CVE-2025-31650", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-dbcp@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:46669317-a779-5dc4-8a32-9413571e0998", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31650 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-dbcp." } }, { "id": "CVE-2025-31651", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-dbcp@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:4d4ed6d0-0b0f-5568-974a-94eb7e3f590f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31651 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-dbcp." } }, { "id": "CVE-2025-46701", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-dbcp@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:f7cf4891-c38b-5c01-b2fc-05f1c0e26718", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-46701 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-dbcp." } }, { "id": "CVE-2025-48988", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-dbcp@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:55623aaa-6af2-5cb0-bfc6-e3f944d386dd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-48988 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-dbcp." } }, { "id": "CVE-2025-48989", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-dbcp@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:1d78150e-94d0-591d-9bb8-4499d8725980", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48989 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-dbcp." } }, { "id": "CVE-2025-49124", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-dbcp@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:4da22cc3-6ec5-5dec-ac47-d2fe92448156", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49124 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-dbcp." } }, { "id": "CVE-2025-49125", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-dbcp@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:3f6b2731-ddc6-594a-8b12-390bb2d008f0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49125 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-dbcp." } }, { "id": "CVE-2025-52520", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-dbcp@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:39f6a4ce-c258-5000-9086-da63966c1906", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-52520 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-dbcp." } }, { "id": "CVE-2025-53506", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-dbcp@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:5cf759e3-bab8-5d00-b47d-dae82a2dc49d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-53506 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-dbcp." } }, { "id": "CVE-2025-55668", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-dbcp@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:c43fc1ab-5404-53b7-867c-e1536d6572e2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55668 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-dbcp." } }, { "id": "CVE-2025-55752", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-dbcp@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:1640ce03-deca-55fd-9ef4-7c9fefc0342d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-55752 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-dbcp. Version 10.1.16 is NOT vulnerable to CVE-2025-55752. The vulnerable code pattern (normalizing before decoding in RewriteValve) was introduced later in version 10.1.40. Version 10.1.16 uses a different code structure that does not call URLDecoder.decode after RequestUtil.normalize, thus the vulnerability is not present. The CVE advisory's version range \"10.1.0-M1 through 10.1.44\" is over-broad; only versions 10.1.40-10.1.44 contain the vulnerable pattern.", "justification": "code_not_present" } }, { "id": "CVE-2025-55754", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-dbcp@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:68b7359a-7ccf-561b-b5db-3e8d4341af6e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55754 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-dbcp." } }, { "id": "CVE-2025-61795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-dbcp@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:76158a65-db7d-56b4-a4a3-09d93bdfa444", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-61795 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-dbcp." } }, { "id": "CVE-2025-66614", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-dbcp@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:494b0a03-d681-556a-aeef-201b8db217c1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66614 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-dbcp." } }, { "id": "CVE-2026-24733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-dbcp@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:5110eb42-887e-56a5-99a6-ed8195bf8ac0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24733 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-dbcp." } }, { "id": "CVE-2026-24734", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-dbcp@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:02861481-e8ec-5230-851a-4ee0fb578979", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24734 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-dbcp." } }, { "id": "CVE-2026-24880", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-dbcp@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:6e707122-5e53-5e86-b893-efab014baabf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24880 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-dbcp." } }, { "id": "CVE-2026-25854", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-dbcp@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:f9e00367-2d2c-5070-a612-3c6ceb32ada2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25854 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-dbcp." } }, { "id": "CVE-2026-29145", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-dbcp@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:3c79e187-71b0-5e12-bb2c-72293f7de89c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29145 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-dbcp." } }, { "id": "CVE-2026-29146", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-dbcp@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:37f85815-5c64-525d-976a-1bd0a5192eff", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29146 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-dbcp." } }, { "id": "CVE-2026-32990", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-dbcp@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:77b8b206-c275-51aa-b37b-69c1ad2de239", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-32990 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-dbcp. not_affected \u2014 Apache Tomcat 10.1.16 is not affected by CVE-2026-32990. The vulnerability exists in the checkSni() method's incomplete fix for CVE-2025-66614, affecting versions 10.1.50-10.1.52. Version 10.1.16 predates the introduction of the strict SNI validation feature entirely - the checkSni method, strictSni field, and protocolHostName parameter do not exist in this version. The vulnerability pattern (c...", "justification": "code_not_present" } }, { "id": "CVE-2026-34483", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-dbcp@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:360d4e30-f1a7-549a-ba5a-abb8cbe4f2eb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34483 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-dbcp." } }, { "id": "CVE-2026-34487", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-dbcp@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:37958621-f717-5363-9584-f4e27d68e29c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34487 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-dbcp." } }, { "id": "CVE-2026-41284", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-dbcp@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:d29249f7-a622-5b19-a06d-5184cc9613e4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41284 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-dbcp." } }, { "id": "CVE-2026-41293", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-dbcp@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:ed613600-7ab4-510b-8bb6-d1953f1ec50a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41293 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-dbcp." } }, { "id": "CVE-2026-42498", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-dbcp@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:9686e056-160c-5809-bab0-27c301bf171b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42498 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-dbcp." } }, { "id": "CVE-2026-43512", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-dbcp@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:298683e9-b808-5d20-a00c-de3463b21e8b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43512 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-dbcp." } }, { "id": "CVE-2026-43513", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-dbcp@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:eba8b685-02f5-5ea1-83c5-d24d8d530cfa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43513 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-dbcp." } }, { "id": "CVE-2026-43514", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-dbcp@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:041a2ffc-56df-5f49-ab8d-df4a8258102c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43514 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-dbcp." } }, { "id": "CVE-2026-43515", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-dbcp@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:eaa77bc2-4011-5a26-95b9-62c66a085c61", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-43515 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-dbcp." } }, { "id": "CVE-2026-53434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-dbcp@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:5966e399-59a1-58e7-9ced-fad9c1e3c856", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53434 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-dbcp." } }, { "id": "CVE-2026-65182", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-dbcp@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:503e23dc-7306-5f2c-b542-a9f049d09c2b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65182 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-dbcp." } }, { "id": "CVE-2026-65905", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-dbcp@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:7c51cf29-a921-5619-accb-589221a8d852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65905 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-dbcp." } }, { "id": "CVE-2026-68525", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-dbcp@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:dec0a11a-5eef-5951-8cb1-087f8294ca0e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68525 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-dbcp." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-dbcp@10.1.16-tuxcare.1" } ] }