{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:ee8c5e3d-7b38-5c8d-ad6f-c17f87b7b74e", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat-jdbc", "purl": "pkg:maven/org.apache.tomcat/tomcat-jdbc@10.1.16-tuxcare.1", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@10.1.16-tuxcare.1", "version": "10.1.16-tuxcare.1", "pedigree": { "ancestors": [ { "name": "tomcat-jdbc", "purl": "pkg:maven/org.apache.tomcat/tomcat-jdbc@10.1.16", "type": "library", "group": "org.apache.tomcat", "version": "10.1.16" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-23672", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:fe2fc7c7-944b-5adb-b17e-9d63c59b183c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-23672 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jdbc." } }, { "id": "CVE-2024-24549", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:972e7f5e-b548-5cd3-8bbe-31048ff5691d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-24549 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jdbc." } }, { "id": "CVE-2024-34750", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:9bc0fabd-401e-5f1f-bdfa-d1ee6b583535", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34750 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jdbc." } }, { "id": "CVE-2024-38286", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:8b9dc434-825f-53b5-9773-9bc8d718d76a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38286 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jdbc." } }, { "id": "CVE-2024-50379", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:047109db-bd12-5c66-b02d-c6a7c29cd8ad", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-50379 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jdbc." } }, { "id": "CVE-2024-52316", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:d475d2b7-6e09-5a46-8967-1e2ff7cb2811", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-52316 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jdbc." } }, { "id": "CVE-2024-54677", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:4ef02824-158e-51ee-948e-e85a1aeef500", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-54677 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jdbc." } }, { "id": "CVE-2024-56337", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:49af7b9b-88b5-586e-8fa6-f06172b4d333", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-56337 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jdbc." } }, { "id": "CVE-2025-24813", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:b71ee6fc-2ed1-5613-876f-c1449a4abb16", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-24813 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jdbc." } }, { "id": "CVE-2025-31650", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:afc38df7-eeda-52f3-98b1-f6affc0a6826", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31650 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jdbc." } }, { "id": "CVE-2025-31651", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:f9ed669f-b04b-5bda-90d2-58ee4c203b66", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31651 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jdbc." } }, { "id": "CVE-2025-46701", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:d8013e33-7812-577f-b447-aadea21b3020", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-46701 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jdbc." } }, { "id": "CVE-2025-48988", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:8914040a-0a9f-58be-b4a3-e701a07259de", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-48988 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jdbc." } }, { "id": "CVE-2025-48989", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:2f5141ab-eb38-57c3-b69b-d4de19c30329", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48989 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jdbc." } }, { "id": "CVE-2025-49124", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:1c89672c-69f9-5045-82fc-10d08e4c3fc4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49124 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jdbc." } }, { "id": "CVE-2025-49125", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:27f6ae4a-1cf0-5923-813a-9f0cf4484577", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49125 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jdbc." } }, { "id": "CVE-2025-52520", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:2981cd20-9330-5ff4-81e9-3f5032837d93", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-52520 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jdbc." } }, { "id": "CVE-2025-53506", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:bd39d625-578f-5bc1-847a-fdaa358120f2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-53506 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jdbc." } }, { "id": "CVE-2025-55668", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:95550ea3-640c-5f95-a969-b95076b18e50", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55668 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jdbc." } }, { "id": "CVE-2025-55752", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:8edda4bd-5cc8-5fd7-aa00-014aaf49ac44", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-55752 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jdbc. Version 10.1.16 is NOT vulnerable to CVE-2025-55752. The vulnerable code pattern (normalizing before decoding in RewriteValve) was introduced later in version 10.1.40. Version 10.1.16 uses a different code structure that does not call URLDecoder.decode after RequestUtil.normalize, thus the vulnerability is not present. The CVE advisory's version range \"10.1.0-M1 through 10.1.44\" is over-broad; only versions 10.1.40-10.1.44 contain the vulnerable pattern.", "justification": "code_not_present" } }, { "id": "CVE-2025-55754", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:6bf3385f-6800-59c0-b624-c62ebdab1a76", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55754 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jdbc." } }, { "id": "CVE-2025-61795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:e5e4e676-45d4-5496-ae41-a301eafb502d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-61795 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jdbc." } }, { "id": "CVE-2025-66614", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:3372e342-a910-5862-9fea-73ee0b7dd204", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66614 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jdbc." } }, { "id": "CVE-2026-24733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:8b37afe1-e893-5b6b-85e0-c347c90814a6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24733 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jdbc." } }, { "id": "CVE-2026-24734", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:ead0ffd5-9356-5d1a-a279-d0f27dd947aa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24734 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jdbc." } }, { "id": "CVE-2026-24880", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:75371c95-f2d5-5fe2-b7aa-b6255122d979", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24880 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jdbc." } }, { "id": "CVE-2026-25854", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:b5175162-7cc9-58d9-8e17-5ae9165c0eba", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25854 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jdbc." } }, { "id": "CVE-2026-29145", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:6cefb290-7635-5121-b29b-80b6d600910d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29145 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jdbc." } }, { "id": "CVE-2026-29146", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:4f10663f-8def-58db-946b-0246bbf2fc55", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29146 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jdbc." } }, { "id": "CVE-2026-32990", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:b60eaa88-d588-5a17-a39b-f05eaaa16a6c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-32990 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jdbc. not_affected \u2014 Apache Tomcat 10.1.16 is not affected by CVE-2026-32990. The vulnerability exists in the checkSni() method's incomplete fix for CVE-2025-66614, affecting versions 10.1.50-10.1.52. Version 10.1.16 predates the introduction of the strict SNI validation feature entirely - the checkSni method, strictSni field, and protocolHostName parameter do not exist in this version. The vulnerability pattern (c...", "justification": "code_not_present" } }, { "id": "CVE-2026-34483", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:e11d6883-c5b1-5f6d-b154-d6602f806d7f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34483 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jdbc." } }, { "id": "CVE-2026-34487", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:c2a3cd33-4a96-50c7-9211-b32d43e4965b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34487 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jdbc." } }, { "id": "CVE-2026-41284", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:e8b4b243-dacd-582d-ac15-79a9f527996e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41284 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jdbc." } }, { "id": "CVE-2026-41293", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:b4bf7776-6281-512a-bb00-5b770fcc06ad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41293 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jdbc." } }, { "id": "CVE-2026-42498", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:bc42eed6-1f12-5888-a84b-52f074d138b2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42498 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jdbc." } }, { "id": "CVE-2026-43512", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:c57ec50c-7d05-5c6c-85ed-6fb34265977a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43512 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jdbc." } }, { "id": "CVE-2026-43513", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:43bc7b5c-56d3-5650-82d5-6700d168fd28", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43513 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jdbc." } }, { "id": "CVE-2026-43514", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:b49106cd-c5ed-5f49-89d4-bdc6e1da8e04", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43514 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jdbc." } }, { "id": "CVE-2026-43515", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:0a0cca0d-f79c-5f6e-adc0-cf94ff0598df", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-43515 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jdbc." } }, { "id": "CVE-2026-53434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:4a93bd78-2204-5ea3-a54c-f0f78b582c32", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53434 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jdbc." } }, { "id": "CVE-2026-65182", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:e22b9fef-43b7-5520-93da-f8f45f2a81a4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65182 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jdbc." } }, { "id": "CVE-2026-65905", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:cbabe406-ca0c-5e36-b050-14049d2f638c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65905 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jdbc." } }, { "id": "CVE-2026-68525", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:5f431d22-8eb3-5048-9269-ba4f2ccd327f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68525 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jdbc." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jdbc@10.1.16-tuxcare.1" } ] }