{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:fe706feb-b084-5e4b-8286-33d047dc4a0f", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat-i18n-zh-CN", "purl": "pkg:maven/org.apache.tomcat/tomcat-i18n-zh-CN@10.1.16-tuxcare.1", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-zh-CN@10.1.16-tuxcare.1", "version": "10.1.16-tuxcare.1", "pedigree": { "ancestors": [ { "name": "tomcat-i18n-zh-CN", "purl": "pkg:maven/org.apache.tomcat/tomcat-i18n-zh-CN@10.1.16", "type": "library", "group": "org.apache.tomcat", "version": "10.1.16" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-23672", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-zh-CN@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:4ddf71eb-78d4-5917-8371-0fd4776ec0a0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-23672 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-zh-CN." } }, { "id": "CVE-2024-24549", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-zh-CN@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:53685144-5aef-5324-b245-598abe2db76a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-24549 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-zh-CN." } }, { "id": "CVE-2024-34750", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-zh-CN@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:43618cb1-7e99-5049-92f3-95aa37a5441e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34750 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-zh-CN." } }, { "id": "CVE-2024-38286", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-zh-CN@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:f84c2bbd-0941-5c2c-b75e-a95cef351de9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38286 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-zh-CN." } }, { "id": "CVE-2024-50379", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-zh-CN@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:ef5b1533-7ab8-524f-aca6-cdc10693307b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-50379 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-zh-CN." } }, { "id": "CVE-2024-52316", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-zh-CN@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:ca7b47a4-3630-5f10-83ef-a61d3c963153", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-52316 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-zh-CN." } }, { "id": "CVE-2024-54677", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-zh-CN@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:24b88e67-b9de-5c38-8d51-f48f1bf7ff18", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-54677 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-zh-CN." } }, { "id": "CVE-2024-56337", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-zh-CN@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:8aeca166-d0f1-5478-9785-48cd0bf450aa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-56337 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-zh-CN." } }, { "id": "CVE-2025-24813", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-zh-CN@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:751539fe-a368-59c9-90b3-73fe5d126c59", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-24813 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-zh-CN." } }, { "id": "CVE-2025-31650", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-zh-CN@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:370429b9-28e3-54e9-860c-ca5dbe5afd2b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31650 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-zh-CN." } }, { "id": "CVE-2025-31651", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-zh-CN@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:74387cd7-676b-55ba-b5c4-bc2acd56e747", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31651 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-zh-CN." } }, { "id": "CVE-2025-46701", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-zh-CN@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:a36ebab0-c013-54bb-b1ba-f42f3eaa59d9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-46701 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-zh-CN." } }, { "id": "CVE-2025-48988", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-zh-CN@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:99df0fe6-2f56-567b-9723-115eebc2219c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-48988 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-zh-CN." } }, { "id": "CVE-2025-48989", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-zh-CN@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:64e09e4c-5e81-5568-bbd1-25bf62b082fe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48989 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-zh-CN." } }, { "id": "CVE-2025-49124", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-zh-CN@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:2ef0e37c-709a-53bf-9fb9-7d132d4a899e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49124 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-zh-CN." } }, { "id": "CVE-2025-49125", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-zh-CN@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:eaa2d101-bfed-5056-ae46-277985fc88a5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49125 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-zh-CN." } }, { "id": "CVE-2025-52520", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-zh-CN@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:d61e5f87-fc1f-510a-a64b-8c3405644386", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-52520 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-zh-CN." } }, { "id": "CVE-2025-53506", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-zh-CN@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:24d1ea6f-a21a-57e4-9825-a91317ce6ee3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-53506 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-zh-CN." } }, { "id": "CVE-2025-55668", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-zh-CN@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:2c6366f0-471f-51fe-b80a-95ecf841fb09", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55668 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-zh-CN." } }, { "id": "CVE-2025-55752", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-zh-CN@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:a054ca9c-c46b-5daf-916f-e5d1a8e9d421", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-55752 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-zh-CN. Version 10.1.16 is NOT vulnerable to CVE-2025-55752. The vulnerable code pattern (normalizing before decoding in RewriteValve) was introduced later in version 10.1.40. Version 10.1.16 uses a different code structure that does not call URLDecoder.decode after RequestUtil.normalize, thus the vulnerability is not present. The CVE advisory's version range \"10.1.0-M1 through 10.1.44\" is over-broad; only versions 10.1.40-10.1.44 contain the vulnerable pattern.", "justification": "code_not_present" } }, { "id": "CVE-2025-55754", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-zh-CN@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:4210b089-afcd-54d7-873b-bc8102f614fe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55754 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-zh-CN." } }, { "id": "CVE-2025-61795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-zh-CN@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:22a06843-c28a-572b-94a8-0110f25bae96", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-61795 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-zh-CN." } }, { "id": "CVE-2025-66614", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-zh-CN@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:a075833a-ff48-568c-8b3a-d78371040131", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66614 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-zh-CN." } }, { "id": "CVE-2026-24733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-zh-CN@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:e0dd6833-565f-54d4-b204-1a8e57179ca3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24733 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-zh-CN." } }, { "id": "CVE-2026-24734", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-zh-CN@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:ac3c228b-2190-5072-bc82-a5d1d6ae6d21", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24734 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-zh-CN." } }, { "id": "CVE-2026-24880", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-zh-CN@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:9e0259f7-015e-544e-8c10-6deb1e9fa100", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24880 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-zh-CN." } }, { "id": "CVE-2026-25854", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-zh-CN@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:edf1afa8-048a-5bdd-b4c5-095c8a9b1ef9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25854 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-zh-CN." } }, { "id": "CVE-2026-29145", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-zh-CN@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:6e07d408-22e6-5ba4-9d44-97c4ce627328", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29145 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-zh-CN." } }, { "id": "CVE-2026-29146", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-zh-CN@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:b2e431af-97b2-5c88-b673-277e971e9ead", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29146 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-zh-CN." } }, { "id": "CVE-2026-32990", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-zh-CN@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:31286b63-66c8-598f-b700-70eb117f65d1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-32990 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-zh-CN. not_affected \u2014 Apache Tomcat 10.1.16 is not affected by CVE-2026-32990. The vulnerability exists in the checkSni() method's incomplete fix for CVE-2025-66614, affecting versions 10.1.50-10.1.52. Version 10.1.16 predates the introduction of the strict SNI validation feature entirely - the checkSni method, strictSni field, and protocolHostName parameter do not exist in this version. The vulnerability pattern (c...", "justification": "code_not_present" } }, { "id": "CVE-2026-34483", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-zh-CN@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:c59a0f86-24f0-5f74-ae82-c7d7642dad34", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34483 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-zh-CN." } }, { "id": "CVE-2026-34487", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-zh-CN@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:44ffbabb-b294-5d4a-9c24-4d42c7757bbc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34487 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-zh-CN." } }, { "id": "CVE-2026-41284", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-zh-CN@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:47f6c5f7-e63e-5ac6-b1dd-99241a894621", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41284 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-zh-CN." } }, { "id": "CVE-2026-41293", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-zh-CN@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:a40234aa-ffad-5ceb-8335-08afcbc01a2c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41293 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-zh-CN." } }, { "id": "CVE-2026-42498", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-zh-CN@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:c940072e-6399-5f9e-b27e-1e6970457ea6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42498 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-zh-CN." } }, { "id": "CVE-2026-43512", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-zh-CN@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:ffe51747-0685-5b4b-bc8e-625f62dec987", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43512 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-zh-CN." } }, { "id": "CVE-2026-43513", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-zh-CN@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:ff2d8676-a217-5817-8662-33ac2d7bc5e5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43513 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-zh-CN." } }, { "id": "CVE-2026-43514", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-zh-CN@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:cc598137-04c4-528d-bf2a-b8a97350a998", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43514 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-zh-CN." } }, { "id": "CVE-2026-43515", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-zh-CN@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:bdfc3059-eea7-5270-8c75-db8e50355516", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-43515 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-zh-CN." } }, { "id": "CVE-2026-53434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-zh-CN@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:b496a8ef-be76-5fb6-933c-c40c31c2c44e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53434 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-zh-CN." } }, { "id": "CVE-2026-65182", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-zh-CN@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:9aeb52b1-4e76-5bb5-91e5-cef32be31cdb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65182 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-zh-CN." } }, { "id": "CVE-2026-65905", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-zh-CN@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:7a773a00-5ec1-5c8c-8ab8-dc0973e50366", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65905 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-zh-CN." } }, { "id": "CVE-2026-68525", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-zh-CN@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:edf19dfe-6ca7-5c20-bf29-ee0d34c106a9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68525 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-zh-CN." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-zh-CN@10.1.16-tuxcare.1" } ] }