{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:14e662b0-af6d-542a-9887-45549c44a20c", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat-i18n-pt-BR", "purl": "pkg:maven/org.apache.tomcat/tomcat-i18n-pt-BR@10.1.16-tuxcare.1", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-pt-BR@10.1.16-tuxcare.1", "version": "10.1.16-tuxcare.1", "pedigree": { "ancestors": [ { "name": "tomcat-i18n-pt-BR", "purl": "pkg:maven/org.apache.tomcat/tomcat-i18n-pt-BR@10.1.16", "type": "library", "group": "org.apache.tomcat", "version": "10.1.16" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-23672", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-pt-BR@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:3cc95eea-8459-5f90-9242-11aaf23aeed4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-23672 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-pt-BR." } }, { "id": "CVE-2024-24549", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-pt-BR@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:7410c72e-5bf8-5751-aff8-7128a59467e0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-24549 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-pt-BR." } }, { "id": "CVE-2024-34750", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-pt-BR@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:70e55e62-1efa-5d60-a300-c5bfb041ebf7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34750 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-pt-BR." } }, { "id": "CVE-2024-38286", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-pt-BR@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:bba4fe07-d381-5f53-82af-4aa558f41480", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38286 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-pt-BR." } }, { "id": "CVE-2024-50379", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-pt-BR@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:0b29a188-13d3-5a0d-9091-c34719279842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-50379 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-pt-BR." } }, { "id": "CVE-2024-52316", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-pt-BR@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:195f9c64-2060-54b8-be86-9c36e588c998", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-52316 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-pt-BR." } }, { "id": "CVE-2024-54677", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-pt-BR@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:be881dd9-f91f-50d2-a6a4-313fd8a13996", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-54677 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-pt-BR." } }, { "id": "CVE-2024-56337", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-pt-BR@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:0b3ca6f1-df22-5283-b437-cfb353eba906", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-56337 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-pt-BR." } }, { "id": "CVE-2025-24813", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-pt-BR@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:45eda002-9061-50ee-9c31-8b7c948710d7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-24813 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-pt-BR." } }, { "id": "CVE-2025-31650", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-pt-BR@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:92ce60c0-cabc-5872-8939-ae4fd2f666d7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31650 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-pt-BR." } }, { "id": "CVE-2025-31651", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-pt-BR@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:1ad1854d-53de-52b6-aae5-c900b0212b3a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31651 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-pt-BR." } }, { "id": "CVE-2025-46701", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-pt-BR@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:f82c675e-ed11-5d3a-8b4a-f838bab91f75", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-46701 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-pt-BR." } }, { "id": "CVE-2025-48988", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-pt-BR@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:f85d9ed6-ef76-57bb-80ef-c02c0b57281a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-48988 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-pt-BR." } }, { "id": "CVE-2025-48989", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-pt-BR@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:c03d753d-deb6-58aa-8892-0df5ef9a5721", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48989 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-pt-BR." } }, { "id": "CVE-2025-49124", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-pt-BR@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:d0694c5a-ecf9-5216-ab93-867331b4ec37", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49124 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-pt-BR." } }, { "id": "CVE-2025-49125", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-pt-BR@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:d8f77b61-d46b-5b8b-b6ac-1c81aa6ae9c0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49125 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-pt-BR." } }, { "id": "CVE-2025-52520", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-pt-BR@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:3d925d6a-c12f-5a59-a643-55ef886bad08", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-52520 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-pt-BR." } }, { "id": "CVE-2025-53506", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-pt-BR@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:25e2bd21-db90-5eff-b26c-de01c1c50f69", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-53506 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-pt-BR." } }, { "id": "CVE-2025-55668", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-pt-BR@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:108edfed-0ccd-56c9-84e5-08b2d3f8aaba", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55668 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-pt-BR." } }, { "id": "CVE-2025-55752", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-pt-BR@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:7b63bfc3-7d06-5389-88c2-78bd0e60c6c4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-55752 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-pt-BR. Version 10.1.16 is NOT vulnerable to CVE-2025-55752. The vulnerable code pattern (normalizing before decoding in RewriteValve) was introduced later in version 10.1.40. Version 10.1.16 uses a different code structure that does not call URLDecoder.decode after RequestUtil.normalize, thus the vulnerability is not present. The CVE advisory's version range \"10.1.0-M1 through 10.1.44\" is over-broad; only versions 10.1.40-10.1.44 contain the vulnerable pattern.", "justification": "code_not_present" } }, { "id": "CVE-2025-55754", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-pt-BR@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:fef0140b-5174-5a7f-ac93-18a5e19a0b3e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55754 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-pt-BR." } }, { "id": "CVE-2025-61795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-pt-BR@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:87646fc4-438f-568a-bad4-2f4313659062", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-61795 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-pt-BR." } }, { "id": "CVE-2025-66614", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-pt-BR@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:9bda66f0-d939-5716-bc95-1957611af903", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66614 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-pt-BR." } }, { "id": "CVE-2026-24733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-pt-BR@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:1c33a755-06fa-5569-becb-d6f5482f32ff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24733 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-pt-BR." } }, { "id": "CVE-2026-24734", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-pt-BR@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:eebf4f18-d9ca-5b2f-9318-cd3b94fe5bb9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24734 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-pt-BR." } }, { "id": "CVE-2026-24880", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-pt-BR@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:9f1b982d-42bb-5a53-bd06-31cdb59676aa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24880 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-pt-BR." } }, { "id": "CVE-2026-25854", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-pt-BR@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:b66ca175-4199-5a6f-80e2-2749d0168650", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25854 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-pt-BR." } }, { "id": "CVE-2026-29145", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-pt-BR@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:76cb0b75-3285-5694-aecd-54bd74bea829", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29145 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-pt-BR." } }, { "id": "CVE-2026-29146", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-pt-BR@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:e1134e89-827a-5a75-be24-ba769a7bb2e3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29146 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-pt-BR." } }, { "id": "CVE-2026-32990", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-pt-BR@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:a1519adc-25ff-52d5-848e-164e764990ca", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-32990 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-pt-BR. not_affected \u2014 Apache Tomcat 10.1.16 is not affected by CVE-2026-32990. The vulnerability exists in the checkSni() method's incomplete fix for CVE-2025-66614, affecting versions 10.1.50-10.1.52. Version 10.1.16 predates the introduction of the strict SNI validation feature entirely - the checkSni method, strictSni field, and protocolHostName parameter do not exist in this version. The vulnerability pattern (c...", "justification": "code_not_present" } }, { "id": "CVE-2026-34483", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-pt-BR@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:00cdc504-916b-5dd7-9dd1-9896a84f4f68", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34483 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-pt-BR." } }, { "id": "CVE-2026-34487", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-pt-BR@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:2204eec9-312c-5cba-8637-cda68ae94d9a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34487 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-pt-BR." } }, { "id": "CVE-2026-41284", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-pt-BR@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:be1e805a-04dd-5b07-8a87-6c111c018c71", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41284 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-pt-BR." } }, { "id": "CVE-2026-41293", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-pt-BR@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:a1817964-a969-5611-9e7f-f645584ff92c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41293 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-pt-BR." } }, { "id": "CVE-2026-42498", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-pt-BR@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:74366ec3-932e-569d-8d21-503fb82c2099", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42498 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-pt-BR." } }, { "id": "CVE-2026-43512", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-pt-BR@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:71ce333d-5213-5c80-a3cd-5bbe9999a95a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43512 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-pt-BR." } }, { "id": "CVE-2026-43513", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-pt-BR@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:fb424457-ad48-5690-8ddb-3209f6ac6d1d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43513 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-pt-BR." } }, { "id": "CVE-2026-43514", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-pt-BR@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:3da3c9a3-20b8-5abd-8218-5cc2e0c0c93b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43514 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-pt-BR." } }, { "id": "CVE-2026-43515", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-pt-BR@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:259635bf-6205-5f17-a65a-9ae8825a5712", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-43515 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-pt-BR." } }, { "id": "CVE-2026-53434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-pt-BR@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:5078ae73-e39b-5bc5-ae01-c55fa29acf5d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53434 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-pt-BR." } }, { "id": "CVE-2026-65182", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-pt-BR@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:ab885d49-e651-52c0-9833-380919b5bcaf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65182 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-pt-BR." } }, { "id": "CVE-2026-65905", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-pt-BR@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:f7cc92af-a7c4-51a3-a0cf-881c64a46ecb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65905 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-pt-BR." } }, { "id": "CVE-2026-68525", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-pt-BR@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:ca88dab9-ab1b-5dd9-92c4-2e12ec7bce91", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68525 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-pt-BR." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-pt-BR@10.1.16-tuxcare.1" } ] }