{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:9803538c-2905-5218-bbb9-c7616b6ac330", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat-el-api", "purl": "pkg:maven/org.apache.tomcat/tomcat-el-api@10.1.16-tuxcare.1", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@10.1.16-tuxcare.1", "version": "10.1.16-tuxcare.1", "pedigree": { "ancestors": [ { "name": "tomcat-el-api", "purl": "pkg:maven/org.apache.tomcat/tomcat-el-api@10.1.16", "type": "library", "group": "org.apache.tomcat", "version": "10.1.16" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-23672", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:79b4318f-f1ba-5bf2-a6aa-55e31c813ad8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-23672 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2024-24549", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:a1c96811-6321-57b3-ba0b-9fe99185c018", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-24549 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2024-34750", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:7f2903d6-cf39-508f-bbd5-a40803468f60", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34750 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2024-38286", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:8e42d2ed-4f0d-5323-acc8-656a6eace265", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38286 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2024-50379", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:e42deebc-63be-58f5-8e6a-9561707149e0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-50379 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2024-52316", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:78fd5e1a-5a89-5d2f-b3f7-f53265422e7d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-52316 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2024-54677", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:43f0c233-1193-5e30-b08e-6fe5d44e82ed", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-54677 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2024-56337", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:d4be2780-a15d-510a-aa14-b0f28985abde", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-56337 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2025-24813", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:bbc418af-8334-5d0f-9525-c429b7a3cd61", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-24813 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2025-31650", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:448d1d7e-87f8-54fc-9ad8-c9570fe84a28", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31650 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2025-31651", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:b1726096-c62f-56d3-8919-7664aae12694", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31651 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2025-46701", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:8806c33f-2818-59e4-87d4-f3249f85af8b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-46701 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2025-48988", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:e8a40485-4abf-5b85-9556-bbeb75f5be68", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-48988 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2025-48989", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:4d8a29ad-1c77-55c1-8b74-ec8ca07d6e38", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48989 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2025-49124", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:df6a378a-b903-5d38-805c-ef9f69427577", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49124 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2025-49125", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:c60ffb9d-9b5c-5481-959e-dbf843a06fc3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49125 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2025-52520", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:670755d7-878b-5aeb-b3b1-9a79ea2cee98", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-52520 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2025-53506", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:29a4dc50-bd2f-5662-be7f-5c74d7ae0d64", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-53506 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2025-55668", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:de533428-8a3d-5653-a062-ba564ef35ba3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55668 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2025-55752", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:6e529639-53ed-56d8-ab0f-8bf42e8c6f9b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-55752 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-el-api. Version 10.1.16 is NOT vulnerable to CVE-2025-55752. The vulnerable code pattern (normalizing before decoding in RewriteValve) was introduced later in version 10.1.40. Version 10.1.16 uses a different code structure that does not call URLDecoder.decode after RequestUtil.normalize, thus the vulnerability is not present. The CVE advisory's version range \"10.1.0-M1 through 10.1.44\" is over-broad; only versions 10.1.40-10.1.44 contain the vulnerable pattern.", "justification": "code_not_present" } }, { "id": "CVE-2025-55754", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:1aa3e911-0012-515e-8e12-4e21e6921fcb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55754 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2025-61795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:13a6c2d0-bd11-569d-a02c-7ea06cc595cf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-61795 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2025-66614", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:63d12fc9-1a5a-5a7d-a568-97a4985bdac4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66614 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2026-24733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:192f8b3f-dcd1-5e57-a981-801561c2b814", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24733 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2026-24734", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:9917c6c0-9224-551d-8886-1444692b088e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24734 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2026-24880", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:cf602e67-d8e2-5b58-bec4-ed09f06f14e1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24880 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2026-25854", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:809254c2-a655-5014-8dc2-c26eddc4494a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25854 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2026-29145", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:094b2426-6a6c-57d2-b2b4-282b51399b20", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29145 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2026-29146", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:ae4d98e1-f99e-5082-b118-9ab04523ed68", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29146 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2026-32990", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:947f0e93-fef5-5221-bf34-a3375c24c634", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-32990 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-el-api. not_affected \u2014 Apache Tomcat 10.1.16 is not affected by CVE-2026-32990. The vulnerability exists in the checkSni() method's incomplete fix for CVE-2025-66614, affecting versions 10.1.50-10.1.52. Version 10.1.16 predates the introduction of the strict SNI validation feature entirely - the checkSni method, strictSni field, and protocolHostName parameter do not exist in this version. The vulnerability pattern (c...", "justification": "code_not_present" } }, { "id": "CVE-2026-34483", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:eecda098-ef0d-57b5-a025-fbb63fae02f0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34483 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2026-34487", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:7f4f30a5-a92a-5542-8f8f-e7b220ed9554", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34487 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2026-41284", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:2306fc1d-f190-53a7-b633-351056ca800b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41284 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2026-41293", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:f5364200-6ca2-57d9-ae15-b26705664a1c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41293 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2026-42498", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:8f5bb212-0055-5c21-a528-377f51b413b0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42498 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2026-43512", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:f579d510-3960-53d0-95a2-09d5317c23f1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43512 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2026-43513", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:58baecb7-43e1-54de-940e-d9138367bd99", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43513 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2026-43514", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:c6ec854a-76ba-5b06-bcef-d4d1169210a4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43514 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2026-43515", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:10869f12-a3b8-54e2-9813-3dd1d769d921", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-43515 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2026-53434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:f0812c34-fe43-5e73-9c49-a4d85a7ca5ba", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53434 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2026-65182", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:ad91605c-c206-50bb-8677-d560d371ba90", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65182 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2026-65905", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:8fa09611-ee0f-5af1-a673-ab98c17ef533", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65905 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2026-68525", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:b9387d37-2f15-59b8-9a6d-6968d09855a2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68525 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@10.1.16-tuxcare.1" } ] }