{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:2432d055-a7e7-5ae8-877e-d58983cc2dfa", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat-i18n-de", "purl": "pkg:maven/org.apache.tomcat/tomcat-i18n-de@10.1.16-tuxcare.1", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-de@10.1.16-tuxcare.1", "version": "10.1.16-tuxcare.1", "pedigree": { "ancestors": [ { "name": "tomcat-i18n-de", "purl": "pkg:maven/org.apache.tomcat/tomcat-i18n-de@10.1.16", "type": "library", "group": "org.apache.tomcat", "version": "10.1.16" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-23672", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-de@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:8159f746-0151-5844-a3fc-dfc41965998f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-23672 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-de." } }, { "id": "CVE-2024-24549", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-de@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:92c989a7-5a34-57d6-9126-85bac8a97fab", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-24549 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-de." } }, { "id": "CVE-2024-34750", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-de@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:fef8be8b-04d7-5866-8cb2-4b39865cb249", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34750 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-de." } }, { "id": "CVE-2024-38286", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-de@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:bcbd4941-2746-5d53-9194-4661ae57e92a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38286 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-de." } }, { "id": "CVE-2024-50379", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-de@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:56c1c287-0f10-5127-8567-d44dc62dfcd6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-50379 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-de." } }, { "id": "CVE-2024-52316", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-de@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:00943666-c6ee-5357-ae4a-ef97e54c7aee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-52316 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-de." } }, { "id": "CVE-2024-54677", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-de@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:4bb90c4b-fcd9-5d33-b2d3-4131618c903f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-54677 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-de." } }, { "id": "CVE-2024-56337", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-de@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:218b5330-13a3-52f4-b96b-e4cb1e95ac55", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-56337 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-de." } }, { "id": "CVE-2025-24813", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-de@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:e09f71aa-deca-5ecf-9c92-8c9d96da4450", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-24813 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-de." } }, { "id": "CVE-2025-31650", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-de@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:536b8134-74d9-5629-9fca-b1d81edc776b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31650 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-de." } }, { "id": "CVE-2025-31651", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-de@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:266cce19-40f2-5583-adb1-3e0d22d1aef6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31651 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-de." } }, { "id": "CVE-2025-46701", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-de@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:bc8f5b5f-ad36-51e6-b61f-c6dcd29e4fd5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-46701 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-de." } }, { "id": "CVE-2025-48988", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-de@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:c211a514-6184-59cf-a3d5-a4240c26cf74", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-48988 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-de." } }, { "id": "CVE-2025-48989", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-de@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:c868b084-cd37-51ea-8bf3-b753c374e0c7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48989 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-de." } }, { "id": "CVE-2025-49124", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-de@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:a41780b5-0b02-51ac-9ba0-5b01a9ce6886", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49124 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-de." } }, { "id": "CVE-2025-49125", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-de@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:cce0b168-150d-58a0-9316-bdc646877a80", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49125 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-de." } }, { "id": "CVE-2025-52520", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-de@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:e256bcb0-f281-590c-9b40-8ff52965f800", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-52520 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-de." } }, { "id": "CVE-2025-53506", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-de@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:4ebf8cef-d684-5b40-bd2a-3b42008e31bd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-53506 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-de." } }, { "id": "CVE-2025-55668", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-de@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:8fe32108-5856-5713-b108-0ba37c4cde45", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55668 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-de." } }, { "id": "CVE-2025-55752", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-de@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:2d7c7409-b558-561b-b2e5-bf714b38b2a5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-55752 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-de. Version 10.1.16 is NOT vulnerable to CVE-2025-55752. The vulnerable code pattern (normalizing before decoding in RewriteValve) was introduced later in version 10.1.40. Version 10.1.16 uses a different code structure that does not call URLDecoder.decode after RequestUtil.normalize, thus the vulnerability is not present. The CVE advisory's version range \"10.1.0-M1 through 10.1.44\" is over-broad; only versions 10.1.40-10.1.44 contain the vulnerable pattern.", "justification": "code_not_present" } }, { "id": "CVE-2025-55754", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-de@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:c3dd1b3b-b36b-5696-a42e-a4074e090c77", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55754 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-de." } }, { "id": "CVE-2025-61795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-de@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:395a7f7c-b3fc-578a-b967-50d345e77613", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-61795 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-de." } }, { "id": "CVE-2025-66614", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-de@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:50298fb6-a4e1-560a-9d3b-a2d855dcf162", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66614 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-de." } }, { "id": "CVE-2026-24733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-de@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:c49afe38-6aa7-5bf9-bc77-eae5a9e590cf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24733 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-de." } }, { "id": "CVE-2026-24734", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-de@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:f31c9b3f-8f25-597f-8127-7dd560cb72b3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24734 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-de." } }, { "id": "CVE-2026-24880", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-de@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:81edda63-0d3d-5af5-b55b-747cef652976", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24880 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-de." } }, { "id": "CVE-2026-25854", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-de@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:6d5cabb0-fe26-5c5d-bfb7-7330914e5b84", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25854 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-de." } }, { "id": "CVE-2026-29145", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-de@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:9462935c-8831-57e1-9bc0-6ee57e465afe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29145 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-de." } }, { "id": "CVE-2026-29146", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-de@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:02e0c5fe-799a-5952-8a55-d2d2dc97aca0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29146 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-de." } }, { "id": "CVE-2026-32990", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-de@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:3f875115-7e78-55d5-b625-354a9b9b09ff", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-32990 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-de. not_affected \u2014 Apache Tomcat 10.1.16 is not affected by CVE-2026-32990. The vulnerability exists in the checkSni() method's incomplete fix for CVE-2025-66614, affecting versions 10.1.50-10.1.52. Version 10.1.16 predates the introduction of the strict SNI validation feature entirely - the checkSni method, strictSni field, and protocolHostName parameter do not exist in this version. The vulnerability pattern (c...", "justification": "code_not_present" } }, { "id": "CVE-2026-34483", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-de@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:6c231731-095d-5976-8869-4c5d37d6a116", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34483 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-de." } }, { "id": "CVE-2026-34487", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-de@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:08676d3e-4d83-570d-8e49-7c67d2363d97", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34487 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-de." } }, { "id": "CVE-2026-41284", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-de@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:0f359991-5563-5149-bc69-430e8e3b22ce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41284 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-de." } }, { "id": "CVE-2026-41293", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-de@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:59c8b55a-df71-5ddb-a38a-6edff4a65c55", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41293 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-de." } }, { "id": "CVE-2026-42498", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-de@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:349e4ab9-9c27-5aa0-b6a6-18cac369c563", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42498 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-de." } }, { "id": "CVE-2026-43512", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-de@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:d249fbb3-66b2-5fa9-83fb-aa1d8e96a052", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43512 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-de." } }, { "id": "CVE-2026-43513", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-de@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:bcca5503-713e-5d8a-8d85-4dd47e748cf1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43513 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-de." } }, { "id": "CVE-2026-43514", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-de@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:756b6984-77a3-5006-8594-cdf54596012a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43514 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-de." } }, { "id": "CVE-2026-43515", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-de@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:43af84e3-8d2a-5f20-aae9-ba2113524148", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-43515 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-de." } }, { "id": "CVE-2026-53434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-de@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:4fba3e44-c1be-5492-8506-39d6bb1802aa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53434 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-de." } }, { "id": "CVE-2026-65182", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-de@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:9531167c-0330-5ab7-85cd-a3362fa8745a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65182 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-de." } }, { "id": "CVE-2026-65905", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-de@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:0c279df7-b759-518f-9b2c-8c838faf684e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65905 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-de." } }, { "id": "CVE-2026-68525", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-de@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:45b61364-b1a0-5d0e-81d6-8c28dcb25178", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68525 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-de." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-de@10.1.16-tuxcare.1" } ] }