{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:6de32d43-a6d9-5636-81e1-cd1b34817840", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat-jasper", "purl": "pkg:maven/org.apache.tomcat/tomcat-jasper@10.1.16-tuxcare.1", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@10.1.16-tuxcare.1", "version": "10.1.16-tuxcare.1", "pedigree": { "ancestors": [ { "name": "tomcat-jasper", "purl": "pkg:maven/org.apache.tomcat/tomcat-jasper@10.1.16", "type": "library", "group": "org.apache.tomcat", "version": "10.1.16" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-23672", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:7d21649f-8998-5641-b77e-51a196775068", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-23672 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper." } }, { "id": "CVE-2024-24549", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:b7352319-306c-5296-be15-278806f86fcb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-24549 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper." } }, { "id": "CVE-2024-34750", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:2208cd0d-1ad6-515a-8929-95be1ac3d886", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34750 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper." } }, { "id": "CVE-2024-38286", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:b2f2d1a6-0f50-513e-9218-8e08c9e70aed", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38286 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper." } }, { "id": "CVE-2024-50379", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:4d824688-0c69-5a93-8315-66c93b4b6ee5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-50379 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper." } }, { "id": "CVE-2024-52316", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:41900e38-8a20-5b5e-a09d-94962460109d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-52316 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper." } }, { "id": "CVE-2024-54677", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:e04a32f2-9156-59da-82ab-3693e095b53d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-54677 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper." } }, { "id": "CVE-2024-56337", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:7013ebf3-0a62-5806-9a3c-8c721c7c5632", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-56337 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper." } }, { "id": "CVE-2025-24813", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:8b915c09-0382-5f70-bec1-b1e7804cab63", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-24813 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper." } }, { "id": "CVE-2025-31650", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:f629437b-5b1d-5d92-8f87-8601db6f5033", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31650 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper." } }, { "id": "CVE-2025-31651", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:30bd532b-4ffa-5d7d-a0b8-d5b958cabd28", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31651 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper." } }, { "id": "CVE-2025-46701", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:051dcf11-d19f-5731-9229-316d84db9987", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-46701 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper." } }, { "id": "CVE-2025-48988", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:f0253603-1045-5792-9863-780e1ac17e0f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-48988 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper." } }, { "id": "CVE-2025-48989", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:bf2b7865-a4ea-591b-be4a-1042c763d568", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48989 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper." } }, { "id": "CVE-2025-49124", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:6ce30685-4f10-53a1-9520-4e067d3f8f11", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49124 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper." } }, { "id": "CVE-2025-49125", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:ad46134c-2e6d-56c8-ad96-ea637df1a8f3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49125 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper." } }, { "id": "CVE-2025-52520", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:d6406ec1-49a5-5a40-a78c-490637d50a7d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-52520 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper." } }, { "id": "CVE-2025-53506", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:6df34380-0818-58e0-aec2-f19f8242f549", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-53506 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper." } }, { "id": "CVE-2025-55668", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:6a4e8538-c51a-5663-a156-16b91639e89f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55668 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper." } }, { "id": "CVE-2025-55752", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:7804bcf0-2709-55ae-96a4-a301872d59ae", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-55752 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper. Version 10.1.16 is NOT vulnerable to CVE-2025-55752. The vulnerable code pattern (normalizing before decoding in RewriteValve) was introduced later in version 10.1.40. Version 10.1.16 uses a different code structure that does not call URLDecoder.decode after RequestUtil.normalize, thus the vulnerability is not present. The CVE advisory's version range \"10.1.0-M1 through 10.1.44\" is over-broad; only versions 10.1.40-10.1.44 contain the vulnerable pattern.", "justification": "code_not_present" } }, { "id": "CVE-2025-55754", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:55e41f5b-2ba8-5b04-adfd-1c27ff2b692b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55754 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper." } }, { "id": "CVE-2025-61795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:ce666c4d-4600-51da-8092-0fbb957f7f0b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-61795 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper." } }, { "id": "CVE-2025-66614", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:a7b1bf09-19e8-5528-8d66-3286d536d918", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66614 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper." } }, { "id": "CVE-2026-24733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:9558cbc5-cf99-52ee-9456-7a8b736e6855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24733 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper." } }, { "id": "CVE-2026-24734", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:7a7246e2-bf60-541d-bf08-d6f1bfbd35e8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24734 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper." } }, { "id": "CVE-2026-24880", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:8fa42cfd-1673-5c1d-8913-207d8a4d54c9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24880 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper." } }, { "id": "CVE-2026-25854", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:45f73295-b63e-5759-ad0d-4f98282ca290", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25854 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper." } }, { "id": "CVE-2026-29145", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:593c05ec-4dbd-5f05-b1c8-5ba4d1fb103c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29145 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper." } }, { "id": "CVE-2026-29146", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:400b892a-0244-5495-aeb4-ad663ed75790", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29146 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper." } }, { "id": "CVE-2026-32990", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:d9109647-2aa3-547c-8177-b1b59df65a9b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-32990 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper. not_affected \u2014 Apache Tomcat 10.1.16 is not affected by CVE-2026-32990. The vulnerability exists in the checkSni() method's incomplete fix for CVE-2025-66614, affecting versions 10.1.50-10.1.52. Version 10.1.16 predates the introduction of the strict SNI validation feature entirely - the checkSni method, strictSni field, and protocolHostName parameter do not exist in this version. The vulnerability pattern (c...", "justification": "code_not_present" } }, { "id": "CVE-2026-34483", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:7e53c760-a18e-5b4d-a00b-8191b40b9d60", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34483 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper." } }, { "id": "CVE-2026-34487", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:7f1241a3-e527-578a-8b17-1dd612e9fcac", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34487 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper." } }, { "id": "CVE-2026-41284", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:a18826f7-162c-5317-9413-0640b568abfa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41284 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper." } }, { "id": "CVE-2026-41293", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:338af3df-eb86-5dc5-a96f-e20da569ada4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41293 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper." } }, { "id": "CVE-2026-42498", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:46ff66cc-4df3-5ec9-b7fb-ce20fe81e67a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42498 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper." } }, { "id": "CVE-2026-43512", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:aa4eed3f-e6d3-5e23-bb4c-36ac9bdf2589", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43512 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper." } }, { "id": "CVE-2026-43513", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:e3b9a503-39a0-5d1e-976f-a5a39dc2df30", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43513 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper." } }, { "id": "CVE-2026-43514", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:5b9f9915-3115-53d9-b0b3-8bfb278cd378", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43514 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper." } }, { "id": "CVE-2026-43515", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:cfe26942-9939-5c79-89da-049708279656", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-43515 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper." } }, { "id": "CVE-2026-53434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:b64d3607-fda0-585d-97a4-8bc164a272af", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53434 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper." } }, { "id": "CVE-2026-65182", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:3253c33d-7dbb-5247-937f-2858ab740f7d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65182 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper." } }, { "id": "CVE-2026-65905", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:8e2982c9-f723-57c1-a632-d431da5c50e9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65905 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper." } }, { "id": "CVE-2026-68525", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:7d656c97-aa7e-54f8-99fd-bc1893594392", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68525 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jasper." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@10.1.16-tuxcare.1" } ] }