{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:d817bf0f-6333-5445-9390-4159e8f22bc3", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat-jasper-el", "purl": "pkg:maven/org.apache.tomcat/tomcat-jasper-el@10.1.16-tuxcare.1", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-jasper-el@10.1.16-tuxcare.1", "version": "10.1.16-tuxcare.1", "pedigree": { "ancestors": [ { "name": "tomcat-jasper-el", "purl": "pkg:maven/org.apache.tomcat/tomcat-jasper-el@10.1.16", "type": "library", "group": "org.apache.tomcat", "version": "10.1.16" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-23672", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper-el@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:3e07da4b-f7ce-5ac4-955c-c1a940fa1c65", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-23672 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper-el." } }, { "id": "CVE-2024-24549", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper-el@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:b83d099c-a4f3-55fe-ace8-2e38f92109e3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-24549 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper-el." } }, { "id": "CVE-2024-34750", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper-el@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:500127cd-d189-5466-88d0-83f573f46e36", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34750 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper-el." } }, { "id": "CVE-2024-38286", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper-el@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:87bd8101-b1e7-579a-b6a8-806b3c4d519b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38286 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper-el." } }, { "id": "CVE-2024-50379", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper-el@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:8c416e57-2632-5f7a-b932-e5c58ea99a86", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-50379 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper-el." } }, { "id": "CVE-2024-52316", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper-el@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:392f0b05-c9ee-5490-8690-21cd7dbe62bf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-52316 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper-el." } }, { "id": "CVE-2024-54677", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper-el@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:21b6a745-b2ab-566f-aede-122eaaf45407", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-54677 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper-el." } }, { "id": "CVE-2024-56337", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper-el@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:0914b8f7-f6cf-5676-a94c-8c4491b8120a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-56337 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper-el." } }, { "id": "CVE-2025-24813", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper-el@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:a99d9683-62a2-58da-993b-597e9de63e16", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-24813 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper-el." } }, { "id": "CVE-2025-31650", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper-el@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:b4c883a0-b369-537b-9618-ab83617b1a07", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31650 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper-el." } }, { "id": "CVE-2025-31651", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper-el@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:8f80e072-15da-5613-9ad0-1482d98ab9a3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31651 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper-el." } }, { "id": "CVE-2025-46701", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper-el@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:5f328868-ce9d-5d3c-9c07-62d3ec86bcd7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-46701 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper-el." } }, { "id": "CVE-2025-48988", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper-el@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:afe7a081-efde-5b3e-954b-4b5a8358a544", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-48988 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper-el." } }, { "id": "CVE-2025-48989", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper-el@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:66cece07-5b5e-563e-832d-7ed41f8e53b3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48989 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper-el." } }, { "id": "CVE-2025-49124", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper-el@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:dc0b6c37-fc4e-58ca-a976-4f8577f8d178", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49124 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper-el." } }, { "id": "CVE-2025-49125", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper-el@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:a0a8ce70-c8db-5f2f-84b1-d35fb1e50935", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49125 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper-el." } }, { "id": "CVE-2025-52520", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper-el@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:e673b1d3-c837-5dc9-9414-413f0bd66d90", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-52520 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper-el." } }, { "id": "CVE-2025-53506", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper-el@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:14f7a004-f7a4-5e6c-9f1a-3156bc5d11cf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-53506 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper-el." } }, { "id": "CVE-2025-55668", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper-el@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:1d1d7839-c5e7-5ec1-a7ec-3935a5a7fa81", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55668 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper-el." } }, { "id": "CVE-2025-55752", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper-el@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:f02cfdf2-0632-50b6-830a-8647748be43f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-55752 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper-el. Version 10.1.16 is NOT vulnerable to CVE-2025-55752. The vulnerable code pattern (normalizing before decoding in RewriteValve) was introduced later in version 10.1.40. Version 10.1.16 uses a different code structure that does not call URLDecoder.decode after RequestUtil.normalize, thus the vulnerability is not present. The CVE advisory's version range \"10.1.0-M1 through 10.1.44\" is over-broad; only versions 10.1.40-10.1.44 contain the vulnerable pattern.", "justification": "code_not_present" } }, { "id": "CVE-2025-55754", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper-el@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:c75b730e-127f-5782-bf62-93e263720d46", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55754 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper-el." } }, { "id": "CVE-2025-61795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper-el@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:d9c209d8-74c9-567e-81a2-5dcef063a7cb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-61795 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper-el." } }, { "id": "CVE-2025-66614", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper-el@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:07b98bf9-c660-5247-afb4-b322d74a8aea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66614 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper-el." } }, { "id": "CVE-2026-24733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper-el@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:401b187e-5e57-5e7a-89e7-1094ff16d7f5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24733 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper-el." } }, { "id": "CVE-2026-24734", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper-el@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:ab5a9d7d-36e5-55b7-a5d7-50303af02648", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24734 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper-el." } }, { "id": "CVE-2026-24880", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper-el@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:17875cb4-2617-5e23-b2d9-27ec3c56743e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24880 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper-el." } }, { "id": "CVE-2026-25854", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper-el@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:1ace3dc3-4ce4-5a85-b51d-1d94c53d1193", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25854 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper-el." } }, { "id": "CVE-2026-29145", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper-el@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:f2cc50d6-5a03-513c-8ba0-b7c5099e4262", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29145 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper-el." } }, { "id": "CVE-2026-29146", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper-el@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:f51df198-1b93-53a8-b4ae-4fdb008ecfcf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29146 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper-el." } }, { "id": "CVE-2026-32990", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper-el@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:fffe6095-f2a4-5726-a58a-15da58595509", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-32990 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper-el. not_affected \u2014 Apache Tomcat 10.1.16 is not affected by CVE-2026-32990. The vulnerability exists in the checkSni() method's incomplete fix for CVE-2025-66614, affecting versions 10.1.50-10.1.52. Version 10.1.16 predates the introduction of the strict SNI validation feature entirely - the checkSni method, strictSni field, and protocolHostName parameter do not exist in this version. The vulnerability pattern (c...", "justification": "code_not_present" } }, { "id": "CVE-2026-34483", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper-el@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:4b1e06c2-3763-56cb-bff4-e743f9367085", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34483 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper-el." } }, { "id": "CVE-2026-34487", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper-el@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:0019c4a7-b88d-5470-b23c-133c09b90ed8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34487 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper-el." } }, { "id": "CVE-2026-41284", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper-el@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:f1d05279-001e-5442-9e58-6ec4bc2149f9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41284 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper-el." } }, { "id": "CVE-2026-41293", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper-el@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:4989c5e5-c4ff-5cbc-90ea-9da2c59ddf99", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41293 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper-el." } }, { "id": "CVE-2026-42498", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper-el@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:6e3d5f0f-258f-543f-8f50-542f627d7ed6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42498 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper-el." } }, { "id": "CVE-2026-43512", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper-el@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:959226b4-87c7-5f7d-8aaf-503104916af9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43512 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper-el." } }, { "id": "CVE-2026-43513", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper-el@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:6c9bc036-05f2-53ae-a37f-f8f30e0c92e7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43513 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper-el." } }, { "id": "CVE-2026-43514", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper-el@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:34b4227f-d39f-56a0-986d-19f3bc9af692", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43514 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper-el." } }, { "id": "CVE-2026-43515", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper-el@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:d3942062-3213-500f-b2bf-11ff1ba9fa52", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-43515 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper-el." } }, { "id": "CVE-2026-53434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper-el@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:efc015bd-b4eb-595f-a208-9b707e31243a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53434 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper-el." } }, { "id": "CVE-2026-65182", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper-el@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:5a25f248-cc2f-5211-a0c4-95cdb39fc3d0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65182 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper-el." } }, { "id": "CVE-2026-65905", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper-el@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:c55115f7-be9c-5a94-a4a4-a73a73724ebd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65905 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper-el." } }, { "id": "CVE-2026-68525", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper-el@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:cd8e199c-fada-546e-85aa-0d5193e9949e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68525 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper-el." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper-el@10.1.16-tuxcare.1" } ] }