{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:4dc20f05-e332-58f1-81cd-c52482f68199", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat-jaspic-api", "purl": "pkg:maven/org.apache.tomcat/tomcat-jaspic-api@10.1.16-tuxcare.1", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-jaspic-api@10.1.16-tuxcare.1", "version": "10.1.16-tuxcare.1", "pedigree": { "ancestors": [ { "name": "tomcat-jaspic-api", "purl": "pkg:maven/org.apache.tomcat/tomcat-jaspic-api@10.1.16", "type": "library", "group": "org.apache.tomcat", "version": "10.1.16" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-23672", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jaspic-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:37f558cc-3ee3-5d95-aa32-d68ae9e54441", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-23672 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jaspic-api." } }, { "id": "CVE-2024-24549", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jaspic-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:fc233507-f1e2-596d-9581-341547478643", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-24549 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jaspic-api." } }, { "id": "CVE-2024-34750", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jaspic-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:109bd9f0-547f-57cd-9739-ac8f2d67c791", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34750 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jaspic-api." } }, { "id": "CVE-2024-38286", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jaspic-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:fa8449b4-77d4-59d6-9694-2b6d09cf00ee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38286 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jaspic-api." } }, { "id": "CVE-2024-50379", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jaspic-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:32f424de-de7c-5927-bdc2-02b77512b3df", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-50379 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jaspic-api." } }, { "id": "CVE-2024-52316", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jaspic-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:06c047df-02fc-5c6c-a340-6710adfe1350", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-52316 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jaspic-api." } }, { "id": "CVE-2024-54677", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jaspic-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:784280b7-f7d6-5116-bbca-769fcecf394e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-54677 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jaspic-api." } }, { "id": "CVE-2024-56337", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jaspic-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:d7b1e6d8-16a5-5182-81c7-dac46302f504", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-56337 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jaspic-api." } }, { "id": "CVE-2025-24813", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jaspic-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:48e1c233-a60c-55bd-a42b-aeea4475d439", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-24813 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jaspic-api." } }, { "id": "CVE-2025-31650", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jaspic-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:7332593b-113b-550a-8464-88089142092b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31650 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jaspic-api." } }, { "id": "CVE-2025-31651", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jaspic-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:ab9c9e71-b65c-5477-812c-598c86dcb3d9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31651 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jaspic-api." } }, { "id": "CVE-2025-46701", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jaspic-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:eae81156-03da-5732-bc02-650103f62e81", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-46701 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jaspic-api." } }, { "id": "CVE-2025-48988", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jaspic-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:5ddf45a3-055e-5516-a193-58a6bfca8119", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-48988 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jaspic-api." } }, { "id": "CVE-2025-48989", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jaspic-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:02206a65-699b-5f3f-86ec-3714e0a14ff5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48989 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jaspic-api." } }, { "id": "CVE-2025-49124", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jaspic-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:06dafbe9-99b8-5083-b04b-a187b5b509f2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49124 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jaspic-api." } }, { "id": "CVE-2025-49125", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jaspic-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:e1ba93f6-2038-5899-8c39-73c36f910dee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49125 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jaspic-api." } }, { "id": "CVE-2025-52520", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jaspic-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:c1aee6f3-1415-50f0-872c-f944a438b7f2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-52520 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jaspic-api." } }, { "id": "CVE-2025-53506", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jaspic-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:963145cd-4127-5372-9871-df433f407eff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-53506 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jaspic-api." } }, { "id": "CVE-2025-55668", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jaspic-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:ae0f3119-2642-5668-8008-1030fb1ef234", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55668 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jaspic-api." } }, { "id": "CVE-2025-55752", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jaspic-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:6b1e4789-8260-501f-a3e2-4ce00d4c4bfd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-55752 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jaspic-api. Version 10.1.16 is NOT vulnerable to CVE-2025-55752. The vulnerable code pattern (normalizing before decoding in RewriteValve) was introduced later in version 10.1.40. Version 10.1.16 uses a different code structure that does not call URLDecoder.decode after RequestUtil.normalize, thus the vulnerability is not present. The CVE advisory's version range \"10.1.0-M1 through 10.1.44\" is over-broad; only versions 10.1.40-10.1.44 contain the vulnerable pattern.", "justification": "code_not_present" } }, { "id": "CVE-2025-55754", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jaspic-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:0e6e6dc2-ec7d-5783-9fa5-e5b7e7ea7634", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55754 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jaspic-api." } }, { "id": "CVE-2025-61795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jaspic-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:f6b65bb7-b880-53c1-8823-32b71af7ce8d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-61795 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jaspic-api." } }, { "id": "CVE-2025-66614", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jaspic-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:8882e3bd-c1f7-581e-9745-c02a459352f2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66614 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jaspic-api." } }, { "id": "CVE-2026-24733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jaspic-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:81700fc9-66b3-5d06-83e5-bf84940dc1c6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24733 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jaspic-api." } }, { "id": "CVE-2026-24734", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jaspic-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:10b9e93a-2930-5dc0-b6f2-53530763efcb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24734 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jaspic-api." } }, { "id": "CVE-2026-24880", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jaspic-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:fa4a976f-995d-5f50-af9c-502a0c5801ef", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24880 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jaspic-api." } }, { "id": "CVE-2026-25854", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jaspic-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:39df13c8-1046-5bea-8de1-ad754bcd2b50", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25854 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jaspic-api." } }, { "id": "CVE-2026-29145", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jaspic-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:430dd8df-578b-5b4b-9e47-9c16c3f5c92a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29145 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jaspic-api." } }, { "id": "CVE-2026-29146", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jaspic-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:da8d5fc3-dccc-54ac-a644-2a296338af0c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29146 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jaspic-api." } }, { "id": "CVE-2026-32990", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jaspic-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:dd04200d-a78b-5018-a99f-cd8b286163c2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-32990 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jaspic-api. not_affected \u2014 Apache Tomcat 10.1.16 is not affected by CVE-2026-32990. The vulnerability exists in the checkSni() method's incomplete fix for CVE-2025-66614, affecting versions 10.1.50-10.1.52. Version 10.1.16 predates the introduction of the strict SNI validation feature entirely - the checkSni method, strictSni field, and protocolHostName parameter do not exist in this version. The vulnerability pattern (c...", "justification": "code_not_present" } }, { "id": "CVE-2026-34483", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jaspic-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:43b745f4-f957-5d7d-a084-4f2b7b667401", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34483 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jaspic-api." } }, { "id": "CVE-2026-34487", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jaspic-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:5959178d-2ed9-5652-8437-540a21b06a0b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34487 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jaspic-api." } }, { "id": "CVE-2026-41284", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jaspic-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:45b1a266-eb8a-5dd6-9f4f-1759eda6f683", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41284 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jaspic-api." } }, { "id": "CVE-2026-41293", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jaspic-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:ff3e025c-a9f9-53bc-bf71-648a246cc0ff", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41293 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jaspic-api." } }, { "id": "CVE-2026-42498", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jaspic-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:f7c907a2-6773-5b8d-bbbd-213f022a0211", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42498 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jaspic-api." } }, { "id": "CVE-2026-43512", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jaspic-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:9492e56a-3970-5ab2-bf6c-dfe6e9dc073a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43512 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jaspic-api." } }, { "id": "CVE-2026-43513", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jaspic-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:ba5a81df-1fd6-55ab-95ea-a56d0c552d00", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43513 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jaspic-api." } }, { "id": "CVE-2026-43514", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jaspic-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:b7001f0e-6afe-5de1-8fc2-249ad19a3e38", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43514 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jaspic-api." } }, { "id": "CVE-2026-43515", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jaspic-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:270d16b8-31ab-5d57-8027-d9b825661477", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-43515 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jaspic-api." } }, { "id": "CVE-2026-53434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jaspic-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:44018ef5-b358-5d9c-b9a6-1ea63b7891f8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53434 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jaspic-api." } }, { "id": "CVE-2026-65182", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jaspic-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:a5aa872f-7899-50a7-893a-f25fcd15b227", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65182 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jaspic-api." } }, { "id": "CVE-2026-65905", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jaspic-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:329a47a0-404c-5535-a62e-53f8762c8095", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65905 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jaspic-api." } }, { "id": "CVE-2026-68525", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jaspic-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:12e9a69f-7d7c-546a-81c0-8cd9880656cf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68525 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jaspic-api." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jaspic-api@10.1.16-tuxcare.1" } ] }