{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:b6c8672d-671f-59a8-b3e0-665d7353bc24", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat-el-api", "purl": "pkg:maven/org.apache.tomcat/tomcat-el-api@9.0.24-tuxcare.1", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@9.0.24-tuxcare.1", "version": "9.0.24-tuxcare.1", "pedigree": { "ancestors": [ { "name": "tomcat-el-api", "purl": "pkg:maven/org.apache.tomcat/tomcat-el-api@9.0.24", "type": "library", "group": "org.apache.tomcat", "version": "9.0.24" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2019-12418", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:47e5e74a-c1ce-5f2d-a898-e1790d2ad508", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-12418 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2019-17563", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:f1b38e4a-e593-5caf-a579-97f66cc18a0c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-17563 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2020-11996", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:4d007623-402f-58cd-a47a-bf9f86ecfeac", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-11996 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2020-13934", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:fbebc763-4c52-5e16-95ba-38d9afcd70ff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-13934 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2020-13935", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:f6da0931-4aff-582d-ad48-f8df59e045f9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-13935 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2020-13943", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:6f5daf63-fd06-5d7e-9aaa-8ffab00a7fce", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-13943 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2020-17527", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:d74db808-0ae2-5b59-8b79-aeb551a96b0d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-17527 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2020-1935", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:6b201b94-9507-585d-a452-973e9f9bd8a5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-1935 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2020-1938", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:d35d9182-6751-5e2e-8785-ddb236fa7396", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-1938 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2020-8022", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:a2d7a138-5454-539d-93c4-0c90a8494a43", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2020-8022 is a false positive for org.apache.tomcat:tomcat-el-api 9.0.24-tuxcare.1." } }, { "id": "CVE-2020-9484", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:cb3d0307-db8b-544f-8ebf-9dc7660302ee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-9484 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2021-24122", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:024e0ab9-9af4-5023-9134-1155ca71bf1f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-24122 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2021-25122", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:8950e654-67c5-591d-ac2d-6180a9890a2b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-25122 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2021-25329", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:f255c23f-0ce7-5dce-a076-b43910918daa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-25329 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2021-30639", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:d76b187c-860d-502d-8a10-0343e6938b9d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-30639 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-el-api. Apache Tomcat 9.0.24 is not affected by CVE-2021-30639. This vulnerability was introduced as a regression in later versions (9.0.44, 8.5.64, 10.0.3-10.0.4) when commit 3082475acb on the 9.0.x line (0a11905b67 on 8.5.x) added an errorException field for improved non-blocking I/O error handling but failed to reset it in the recycle() method. Version 9.0.24 predates this change and does not contain the errorException field, making the vulnerability pattern impossible to manifest.", "justification": "code_not_present" } }, { "id": "CVE-2021-30640", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:cc047333-cc6f-595f-9fdf-66a4af5491bb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-30640 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2021-33037", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:0480488b-04f6-549d-8e9b-340a52ee0833", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-33037 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2021-41079", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:f6426395-be3f-5cef-ae7f-f3243e821a23", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-41079 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2021-42340", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:025f35b1-1a0c-5dd1-94fb-267d476d5721", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-42340 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-el-api. Version 9.0.24 is not affected by CVE-2021-42340. The vulnerability was introduced by the bug 63362 fix in October 2020 (affecting versions 9.0.40+), which added the UpgradeInfo object for metrics collection. Version 9.0.24 (released August 2019) predates this change and does not contain UpgradeInfo, therefore the vulnerable pattern does not exist in this version.", "justification": "code_not_present" } }, { "id": "CVE-2021-43980", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:01dec92b-761f-564b-9e5a-b730bc32e6a2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-43980 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-el-api. not_affected \u2014 Tomcat 9.0.24 is NOT AFFECTED by CVE-2021-43980. The CVE states \"The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9.0.47 onwards exposed a long standing concurrency bug.\" Version 9.0.24 predates this architectural change (9.0.47) and uses the older ConcurrentHashMap-based processor management instead of the vulnerable currentProcessor ...", "justification": "code_not_present" } }, { "id": "CVE-2022-23181", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:ba1cf0b1-f583-50be-81ed-eb1d7162ad1b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-23181 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2022-29885", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:9e341791-24d8-50f9-ab9d-ac36556aeb06", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-29885 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2022-34305", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:273a6d9f-ca2f-5a0f-a1a5-54110faabdf8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-34305 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-el-api. not_affected \u2014 Version 9.0.24 is not affected by CVE-2022-34305. The vulnerable code (unfiltered display of session and principal attributes in HTML tables) was added in commit 4666a36eb6 on 2019-11-28, more than 3 months after version 9.0.24 was tagged on 2019-08-14. The file `/webapps/examples/jsp/security/protected/index.jsp` in version 9.0.24 has only 82 lines and does not contain the code that iterates o...", "justification": "code_not_present" } }, { "id": "CVE-2022-42252", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:65151cdc-1027-5a51-abd4-4b3d287f7d62", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-42252 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2022-45143", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:73cae960-cd09-5ed5-a379-e9f7c25bb5cf", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-45143 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-el-api. Apache Tomcat 9.0.24 is not affected by CVE-2022-45143. The vulnerability concerns JsonErrorReportValve, a component that does not exist in version 9.0.24. JsonErrorReportValve was introduced in Tomcat 9.0.40. Version 9.0.24 only contains ErrorReportValve, which produces HTML error pages and properly escapes user-controlled data using Escape.htmlElementContent(). The CVE's stated affected range (9.0.40 to 9.0.68) accurately reflects when the vulnerable component was introduced.", "justification": "code_not_present" } }, { "id": "CVE-2023-24998", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:76e6e4ee-cad5-55fc-8a61-c217983f36a5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-24998 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2023-28708", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:00d891d9-be1d-5f57-bd47-a53414604d82", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-28708 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2023-41080", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:316ddc02-83aa-55dd-8114-cf72013d0bc2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-41080 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2023-42795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:d2509b73-b3f2-53a1-b595-c20da88b2df2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-42795 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2023-44487", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:c4da223d-2540-5215-b851-1d708733d44e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-44487 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2023-45648", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:34515b36-46ad-5806-82f2-326196d85b5e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-45648 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2023-46589", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:29c573a6-9be4-5c3f-9125-e2f6fed592e4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-46589 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2024-21733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:c9e5e8db-8752-581c-aa86-19de04d130be", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-21733 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2024-23672", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:0c57135c-635c-5338-8d38-edec63fcd305", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-23672 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2024-24549", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:4a689f3a-92db-5c8d-a16e-29b148a864b2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-24549 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2024-34750", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:c2690442-9db5-5240-bf1f-67cafe782b57", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-34750 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2024-38286", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:5fae6098-6588-5686-a927-e52dc7b454bc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38286 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2024-50379", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:5eaa74a8-b568-5de6-8e58-59a3058c302d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-50379 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2024-52316", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:7a34b410-2a77-57a7-94b8-8299e8bfe43b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-52316 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2024-54677", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:b505f58e-0893-5048-9c07-2eb119308ee9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-54677 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2024-56337", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:7773586b-96b2-5a8e-8dda-4bfd1c1e65ac", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-56337 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2025-24813", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:3cc669a1-2919-5df8-96d0-7205b54f6606", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-24813 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2025-31650", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:9e7ad4e4-1965-57a1-88e0-af944e3f2762", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-31650 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-el-api. Apache Tomcat 9.0.24 is not affected by CVE-2025-31650. The vulnerability affects HTTP/2 extensible priorities (RFC 9218) support, which was not implemented in this version. The target lacks all vulnerable code paths: PRIORITY_UPDATE frame handling, Priority.parsePriority() method, and priority HTTP header processing. The CVE's affected version range starts at 9.0.76, consistent with RFC 9218 support being added after 9.0.24.", "justification": "code_not_present" } }, { "id": "CVE-2025-31651", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:7ea31e32-49dc-5325-af94-0f8da4a776d8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31651 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2025-46701", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:1b357410-d036-5700-aac3-d2f57a3e29c0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-46701 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2025-48988", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:e7d0a979-982e-5c4b-b8fc-90dc080d2936", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48988 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2025-48989", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:c950ca2c-ea4d-596f-8ee5-ecb080c15995", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48989 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2025-49124", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:a4a819cc-5ad9-5396-bff2-ad9de1220384", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-49124 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2025-49125", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:23609fd2-4ab3-5349-a710-6f5a4811e33c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-49125 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2025-52434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:67d0f08f-8c27-5be5-b3d4-110eefdd4219", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-52434 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2025-52520", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:a85766ba-0149-5d09-8aeb-c92f782cd378", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-52520 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2025-53506", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:fa703223-f2a8-5ff6-9a1e-93b26c4eacf5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-53506 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2025-55668", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:885a0903-dd54-5c88-98d7-fb55498d0bcf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-55668 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2025-55752", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:8b68d8f7-078d-5bb9-979a-f9f1a2448403", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-55752 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2025-61795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:d55e0fd3-2f2f-515a-b0e1-50fc806c03eb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-61795 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2025-66614", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:ea5a2f37-ee3c-55c5-bc27-e662a970557c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66614 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2026-24733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:c489e5f2-9f97-51a6-bdc5-570962c28b13", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-24733 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2026-24880", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:5396bd2a-d084-56bd-8ed1-c2089c2c4713", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24880 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2026-25854", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:17757408-5dad-586a-8b06-17549b0c3208", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25854 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2026-29146", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:b6f2e190-50b2-50e9-a94f-8782d9daa7c7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29146 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2026-32990", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:54ac9b85-012d-5ded-8d3e-64ee7f802ddd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-32990 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-el-api. not_affected \u2014 CVE-2026-32990 affects the checkSni() method in AbstractEndpoint.java, which validates SNI hostnames against protocol-level host headers. This method was introduced by CVE-2025-66614 in Tomcat versions 9.0.113+, 10.1.50+, and 11.0.15+. The current target (version 9.0.24) predates this feature entirely - the checkSni() method, strictSni configuration, and SNI-vs-protocol-hostname validation logi...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-34487", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:d3625cdd-c25b-5b81-971d-6cb3f1adcceb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34487 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2026-41284", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:eb4c6db4-7cf4-516c-b0e8-24911a45451a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41284 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2026-41293", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:dc961cec-7a9c-5b3b-8b6a-21609761d9ec", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41293 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2026-42498", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:f26657c3-960f-519d-8bda-16ab30daadf3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42498 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2026-43512", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:4ccba557-28b1-5ae1-b374-9efbca703d83", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43512 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2026-43513", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:f681d1d0-61ac-5682-81fb-5dc86eb84bae", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43513 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2026-43514", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:c6767953-2d83-5b29-b4ad-bd65cba71b1f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43514 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2026-43515", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:c268aeb6-5013-5ee4-b993-c9baf9aa71e9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43515 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2026-65182", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:229a5cbd-f0a3-55df-8f2a-01284bbb2446", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65182 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2026-65905", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:bf653031-9bc4-5033-af88-232fcc481faa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65905 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2026-68525", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:9aa76da0-76eb-53db-8856-894183a3702c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-68525 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-el-api." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@9.0.24-tuxcare.1" } ] }