{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:c77ab49b-2327-5174-874a-df3facc00183", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat-i18n-ja", "purl": "pkg:maven/org.apache.tomcat/tomcat-i18n-ja@10.1.16-tuxcare.1", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ja@10.1.16-tuxcare.1", "version": "10.1.16-tuxcare.1", "pedigree": { "ancestors": [ { "name": "tomcat-i18n-ja", "purl": "pkg:maven/org.apache.tomcat/tomcat-i18n-ja@10.1.16", "type": "library", "group": "org.apache.tomcat", "version": "10.1.16" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-23672", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ja@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:8c11da9a-af63-515b-a9da-fa1221e92490", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-23672 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ja." } }, { "id": "CVE-2024-24549", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ja@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:6a5e1c37-5225-5b47-a70f-9f2f847e7b29", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-24549 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ja." } }, { "id": "CVE-2024-34750", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ja@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:9b836708-fc67-5d7f-862b-0f7926d33241", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34750 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ja." } }, { "id": "CVE-2024-38286", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ja@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:fcb72d0c-96c7-5bf3-bc05-c3064fb94c27", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38286 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ja." } }, { "id": "CVE-2024-50379", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ja@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:784f8214-23f7-5cd4-afdd-4ed4af03220b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-50379 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ja." } }, { "id": "CVE-2024-52316", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ja@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:4a922f2b-faea-5496-9cfb-fe046808f5ba", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-52316 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ja." } }, { "id": "CVE-2024-54677", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ja@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:b23ef27c-2215-51f4-ae1b-bd0d6431a0d8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-54677 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ja." } }, { "id": "CVE-2024-56337", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ja@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:9d8263a2-0589-5a32-b2c4-442367ece334", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-56337 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ja." } }, { "id": "CVE-2025-24813", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ja@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:db7fa7f3-29a6-5dc3-95e3-746ea2b2af05", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-24813 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ja." } }, { "id": "CVE-2025-31650", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ja@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:26c5f1f6-7baf-593f-a830-286a0085c726", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31650 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ja." } }, { "id": "CVE-2025-31651", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ja@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:fc946847-6f2f-595d-a94e-4ba7a32c1909", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31651 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ja." } }, { "id": "CVE-2025-46701", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ja@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:bc7c9980-e1af-5a4f-911d-b10477882768", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-46701 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ja." } }, { "id": "CVE-2025-48988", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ja@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:a4edd6d0-8ef1-5fbe-81dc-ad9ec618d309", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-48988 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ja." } }, { "id": "CVE-2025-48989", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ja@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:7f589c86-52e2-587b-8b8b-a56b6f2980fd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48989 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ja." } }, { "id": "CVE-2025-49124", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ja@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:9c59c491-767d-5130-b826-fe6b6728bb1e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49124 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ja." } }, { "id": "CVE-2025-49125", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ja@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:21b37ea6-60d7-5029-8931-1e2e8531d2e0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49125 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ja." } }, { "id": "CVE-2025-52520", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ja@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:a50a0ccf-f5e6-5713-b414-a28e20f558ff", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-52520 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ja." } }, { "id": "CVE-2025-53506", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ja@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:544acdaa-12a4-5c13-a8ab-3e14355c8b2e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-53506 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ja." } }, { "id": "CVE-2025-55668", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ja@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:57f655b4-9312-5011-bc7f-d28863092a39", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55668 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ja." } }, { "id": "CVE-2025-55752", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ja@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:c4a24ac8-38e0-5464-9538-cc48629e48b1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-55752 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ja. Version 10.1.16 is NOT vulnerable to CVE-2025-55752. The vulnerable code pattern (normalizing before decoding in RewriteValve) was introduced later in version 10.1.40. Version 10.1.16 uses a different code structure that does not call URLDecoder.decode after RequestUtil.normalize, thus the vulnerability is not present. The CVE advisory's version range \"10.1.0-M1 through 10.1.44\" is over-broad; only versions 10.1.40-10.1.44 contain the vulnerable pattern.", "justification": "code_not_present" } }, { "id": "CVE-2025-55754", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ja@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:22a3a94a-cdcb-5730-ab16-fd903fa6c627", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55754 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ja." } }, { "id": "CVE-2025-61795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ja@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:d06df7ea-e827-5ae1-913c-2d0b2c19965d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-61795 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ja." } }, { "id": "CVE-2025-66614", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ja@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:5d4d54a0-96ce-54d8-a3e9-6b343f0b8395", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66614 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ja." } }, { "id": "CVE-2026-24733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ja@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:0ea1d1a4-5ec3-5fff-893d-2eb301c2f885", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24733 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ja." } }, { "id": "CVE-2026-24734", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ja@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:c6ebcb63-1a24-52a5-bce8-f74da2d9f515", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24734 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ja." } }, { "id": "CVE-2026-24880", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ja@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:2f80f9c6-d6ab-5408-9d76-6f55cd0ae714", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24880 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ja." } }, { "id": "CVE-2026-25854", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ja@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:c551e400-35ec-59aa-88fd-34a5eb1ccb26", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25854 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ja." } }, { "id": "CVE-2026-29145", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ja@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:db5b2b54-3ed3-501c-95af-3b13c5e7300a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29145 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ja." } }, { "id": "CVE-2026-29146", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ja@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:d6d03b40-ea01-5055-8e8a-4adcf9fb83db", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29146 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ja." } }, { "id": "CVE-2026-32990", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ja@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:1cae9d1a-b16b-57d5-915b-98289f0fa9bf", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-32990 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ja. not_affected \u2014 Apache Tomcat 10.1.16 is not affected by CVE-2026-32990. The vulnerability exists in the checkSni() method's incomplete fix for CVE-2025-66614, affecting versions 10.1.50-10.1.52. Version 10.1.16 predates the introduction of the strict SNI validation feature entirely - the checkSni method, strictSni field, and protocolHostName parameter do not exist in this version. The vulnerability pattern (c...", "justification": "code_not_present" } }, { "id": "CVE-2026-34483", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ja@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:9bad0845-83cb-553b-abd6-f5a05a0b211d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34483 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ja." } }, { "id": "CVE-2026-34487", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ja@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:46226eee-ee17-5ae4-819b-606451bf1291", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34487 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ja." } }, { "id": "CVE-2026-41284", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ja@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:077841a8-dce2-5a11-bf81-4365fe7bcb65", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41284 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ja." } }, { "id": "CVE-2026-41293", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ja@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:cead3918-620f-5c6a-8375-e39dce89019a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41293 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ja." } }, { "id": "CVE-2026-42498", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ja@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:44439a84-ff71-52e7-aa3d-e9f3f3b7a41e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42498 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ja." } }, { "id": "CVE-2026-43512", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ja@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:3622542a-7897-5121-b28e-3fc0cfcf32b0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43512 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ja." } }, { "id": "CVE-2026-43513", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ja@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:d4ee8675-64b9-5402-8c7a-2d0542af5d68", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43513 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ja." } }, { "id": "CVE-2026-43514", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ja@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:02a3b61f-07be-50de-bcf1-a32594a530fd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43514 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ja." } }, { "id": "CVE-2026-43515", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ja@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:7e0eadde-f485-5967-b3fd-f149cd88be28", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-43515 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ja." } }, { "id": "CVE-2026-53434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ja@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:f591dc7c-4365-5ab5-8109-b76d0fa3fd1b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53434 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ja." } }, { "id": "CVE-2026-65182", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ja@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:71d1c4dc-a28e-55e4-a3e0-0f8d371a3689", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65182 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ja." } }, { "id": "CVE-2026-65905", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ja@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:cd12a3fc-d180-58e1-9d50-08175a0870fb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65905 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ja." } }, { "id": "CVE-2026-68525", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ja@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:805a1848-95fd-5542-9632-5f184f183054", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68525 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ja." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ja@10.1.16-tuxcare.1" } ] }