{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:c5bd406a-7f87-5866-8169-39c420be33a4", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat-dbcp", "purl": "pkg:maven/org.apache.tomcat/tomcat-dbcp@10.1.50-tuxcare.2", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-dbcp@10.1.50-tuxcare.2", "version": "10.1.50-tuxcare.2", "pedigree": { "ancestors": [ { "name": "tomcat-dbcp", "purl": "pkg:maven/org.apache.tomcat/tomcat-dbcp@10.1.50", "type": "library", "group": "org.apache.tomcat", "version": "10.1.50" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-23672", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-dbcp@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:e69855e5-ea42-5d11-86d4-83e85f3febba", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-23672 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-dbcp. not_affected \u2014 Apache Tomcat 10.1.50 is not affected by CVE-2024-23672. The vulnerability (incomplete WebSocket connection cleanup leading to resource exhaustion) was fixed in upstream Apache Tomcat 10.1.19 (released February 2024). Since version 10.1.50 was released December 2025 (much later than the fix), it inherently includes the upstream fix. The target code contains all fix components: SESSION_CLOSE_TIM...", "justification": "code_not_present" } }, { "id": "CVE-2024-24549", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-dbcp@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:c393edc1-0a17-51d0-aa46-d50ea38e92bd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-24549 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-dbcp. Apache Tomcat 10.1.50 is not affected by CVE-2024-24549. The vulnerability affects versions up to 10.1.18, and was fixed by Apache in version 10.1.19. The target version 10.1.50 was onboarded with the upstream vendor fix already present. The fix moves HTTP/2 header validation from the end of header processing to the end of each frame (HEADERS and CONTINUATION), preventing resource exhaustion from processing excessive headers.", "justification": "code_not_present" } }, { "id": "CVE-2024-52316", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-dbcp@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:17cb1072-8dc7-5b50-8725-1f8939add805", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-52316 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-dbcp. not_affected \u2014 Target is Apache Tomcat 10.1.50. CVE-2024-52316 (Unchecked Error Condition in Jakarta Authentication / JASPIC) affects 10.1.0-M1 through 10.1.30 and is fixed in 10.1.31. The target (10.1.50) already ships the upstream fix natively. The upstream patch (commit acc2f01/7532f9dc, \"If the Jakarta Authentication fails with an exception, set a 500 status\") adds an explicit response.setStatus(SC_INTERNAL_SERVER_ERROR) in the AuthException catch block of AuthenticatorBase.authenticateJaspic(), so a custom ServerAuthContext that throws during validateRequest() can no longer leave the request in a non-failure state (authentication-bypass). That exact fix is present in the target at java/org/apache/catalina/authenticator/AuthenticatorBase.java lines 806-807. git blame attributes those lines to upstream Apache commit acc2f01395f895980f5d8a64573fcc1bade13369 by Mark Thomas , and git show confirms the fix already exists at the upstream 10.1.50 tag (cd6d685800), which is a direct parent of HEAD. No TuxCare backport branch for this CVE targets 10.1.50 (backports exist only for older versions). Verdict: not_affected (upstream vendor fix baked into the shipped version); justification code_not_present. [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-21; the earlier Sonnet run was parked by the author-verification gate after crediting a TuxCare backport for an upstream fix]", "justification": "code_not_present" } }, { "id": "CVE-2025-48988", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-dbcp@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:664cb31a-852d-5373-94cc-4bbbe5c18a86", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-48988 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-dbcp. CVE-2025-48988 is NOT present in Apache Tomcat 10.1.50. The upstream fix that adds maxPartCount and maxPartHeaderSize limits to prevent resource exhaustion during multipart request processing is already present in the target version. The fix was authored by Mark Thomas (Apache upstream) in commit cdde8e655bc1c5c60a07efd216251d77c52fd7f6 and is part of the 10.1.50 release.", "justification": "code_not_present" } }, { "id": "CVE-2025-49125", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-dbcp@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:1001e996-1c44-57da-9e5c-f1d1a2c6cf5f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-49125 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-dbcp. Target version 10.1.50 already contains the upstream Apache Tomcat fix for CVE-2025-49125. The vulnerable path.startsWith(webAppMount) pattern has been replaced with the secure isPathMounted() method that enforces proper path boundary checking. The fix was authored by Mark Thomas (markt@apache.org) in upstream commit 7617b9c247bc77ed0444dd69adcd8aa48777886c and was included in upstream version 10.1.42. Since 10.1.50 > 10.1.42, the fix was already present when TuxCare onboarded this version.", "justification": "code_not_present" } }, { "id": "CVE-2026-24734", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-dbcp@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:158e4a09-1a5e-5d08-85e0-2f1da793dce5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24734 affects version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-dbcp." } }, { "id": "CVE-2026-24880", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-dbcp@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:47d2c48f-52b8-5d7d-ad00-afcc9ff8c016", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-24880 is fixed in version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-dbcp." } }, { "id": "CVE-2026-25854", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-dbcp@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:107e8abf-6d00-5b7d-80ac-eff645288888", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25854 is fixed in version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-dbcp." } }, { "id": "CVE-2026-29145", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-dbcp@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:c55bbd54-d6aa-5e42-a87c-ed1755359813", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29145 is fixed in version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-dbcp." } }, { "id": "CVE-2026-29146", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-dbcp@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:61aa6fca-185e-58ce-9386-d0f1c15e894f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29146 is fixed in version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-dbcp." } }, { "id": "CVE-2026-32990", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-dbcp@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:872629ce-1f8c-5f07-ae8e-44b0a9808cd4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32990 is fixed in version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-dbcp." } }, { "id": "CVE-2026-34483", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-dbcp@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:f14ff7e6-1d86-51d2-bd46-88970de241bf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34483 is fixed in version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-dbcp." } }, { "id": "CVE-2026-34487", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-dbcp@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:e7a1629e-ebb4-53a5-a0bf-89936dfc483e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34487 is fixed in version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-dbcp." } }, { "id": "CVE-2026-34500", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-dbcp@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:7da614d6-6d92-5d88-8ec8-c9790aa774bc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34500 affects version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-dbcp." } }, { "id": "CVE-2026-41284", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-dbcp@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:674d7df7-a80c-5aa1-a9b6-c01dcbe1e07c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41284 is fixed in version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-dbcp." } }, { "id": "CVE-2026-41293", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-dbcp@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:a65f668c-8451-5082-bafc-41bddcc0798d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41293 is fixed in version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-dbcp." } }, { "id": "CVE-2026-42498", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-dbcp@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:b83e5df7-1e46-5b9c-b65f-40b89758eacc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42498 is fixed in version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-dbcp." } }, { "id": "CVE-2026-43512", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-dbcp@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:3e62d9fb-60df-5260-8654-130e613c089e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43512 affects version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-dbcp." } }, { "id": "CVE-2026-43513", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-dbcp@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:45b50733-ee5a-537b-bfdd-ba0ee3c6dc10", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-43513 is fixed in version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-dbcp." } }, { "id": "CVE-2026-43514", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-dbcp@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:3406c536-b482-5935-8b77-586bae323d8a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43514 affects version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-dbcp." } }, { "id": "CVE-2026-43515", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-dbcp@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:e9e7fa3f-31fd-572e-b790-7367722c0210", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43515 affects version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-dbcp." } }, { "id": "CVE-2026-53434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-dbcp@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:f305d857-bc54-5424-b778-880b91f86f0f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53434 affects version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-dbcp." } }, { "id": "CVE-2026-65182", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-dbcp@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:25a8b3d6-a8bb-57ae-9eda-c2a034e412e0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65182 is fixed in version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-dbcp." } }, { "id": "CVE-2026-65905", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-dbcp@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:390442e1-4678-52ce-b026-4842e72164d9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65905 is fixed in version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-dbcp." } }, { "id": "CVE-2026-68525", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-dbcp@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:3bb92974-e642-51ec-915f-38f7fb4f26ee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68525 is fixed in version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-dbcp." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-dbcp@10.1.50-tuxcare.2" } ] }