{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:2b24243d-a54f-51f5-bfae-963d561d0c53", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat-jni", "purl": "pkg:maven/org.apache.tomcat/tomcat-jni@10.1.16-tuxcare.1", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-jni@10.1.16-tuxcare.1", "version": "10.1.16-tuxcare.1", "pedigree": { "ancestors": [ { "name": "tomcat-jni", "purl": "pkg:maven/org.apache.tomcat/tomcat-jni@10.1.16", "type": "library", "group": "org.apache.tomcat", "version": "10.1.16" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-23672", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jni@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:8721c0d4-7a63-5d3a-9b22-cfc7e650dd9b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-23672 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jni." } }, { "id": "CVE-2024-24549", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jni@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:d5f040b9-b537-5b27-8e40-d734a9867e6f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-24549 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jni." } }, { "id": "CVE-2024-34750", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jni@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:94765437-6797-535d-9454-a8bf388069b2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34750 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jni." } }, { "id": "CVE-2024-38286", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jni@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:86c3fa17-446a-51b9-91a6-4f8793ffe946", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38286 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jni." } }, { "id": "CVE-2024-50379", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jni@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:8c5f3836-eb33-5e4e-bfb2-ea55ee7fe860", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-50379 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jni." } }, { "id": "CVE-2024-52316", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jni@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:31f0dcd2-e3d0-5589-98b6-b7b10a082243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-52316 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jni." } }, { "id": "CVE-2024-54677", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jni@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:f9dd7352-f6a0-56a9-8da3-ff13a1f26935", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-54677 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jni." } }, { "id": "CVE-2024-56337", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jni@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:f5c72f6d-c414-56a5-a98f-411d6e5b18c2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-56337 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jni." } }, { "id": "CVE-2025-24813", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jni@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:48ba82ea-bd2c-593e-ad5b-e97ec301690f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-24813 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jni." } }, { "id": "CVE-2025-31650", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jni@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:a2cdba62-f269-5153-b9ca-a94d56308a08", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31650 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jni." } }, { "id": "CVE-2025-31651", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jni@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:8201836a-940b-5801-8327-2be2a6311e8c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31651 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jni." } }, { "id": "CVE-2025-46701", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jni@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:3e0cc12d-02e4-58a5-ad7e-3032b23dc63d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-46701 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jni." } }, { "id": "CVE-2025-48988", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jni@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:6e856c3f-c4ca-5b4b-a6eb-bf3a95fb2134", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-48988 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jni." } }, { "id": "CVE-2025-48989", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jni@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:4b42ad7c-93e2-5107-96d7-a7f881a3b228", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48989 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jni." } }, { "id": "CVE-2025-49124", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jni@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:1bf274ed-148c-55f7-8f18-2be2877dc005", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49124 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jni." } }, { "id": "CVE-2025-49125", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jni@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:e04444be-0e6e-525d-a088-b6c9512d8aec", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49125 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jni." } }, { "id": "CVE-2025-52520", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jni@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:4795229e-9e00-5ac8-881a-26696a2ba2bc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-52520 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jni." } }, { "id": "CVE-2025-53506", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jni@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:024aad15-e1c2-5511-8a22-f5fc62a61450", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-53506 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jni." } }, { "id": "CVE-2025-55668", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jni@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:1ceee37a-d4fd-58f5-9ddf-8bcd1be15fd4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55668 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jni." } }, { "id": "CVE-2025-55752", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jni@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:f936989d-6aaf-5434-a57c-4ddf9f288cc2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-55752 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jni. Version 10.1.16 is NOT vulnerable to CVE-2025-55752. The vulnerable code pattern (normalizing before decoding in RewriteValve) was introduced later in version 10.1.40. Version 10.1.16 uses a different code structure that does not call URLDecoder.decode after RequestUtil.normalize, thus the vulnerability is not present. The CVE advisory's version range \"10.1.0-M1 through 10.1.44\" is over-broad; only versions 10.1.40-10.1.44 contain the vulnerable pattern.", "justification": "code_not_present" } }, { "id": "CVE-2025-55754", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jni@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:d1229ed5-a6c8-5ce0-b9b2-3b0f70180f5a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55754 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jni." } }, { "id": "CVE-2025-61795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jni@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:6e58c14a-569b-5883-8bda-84fcc5497fb7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-61795 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jni." } }, { "id": "CVE-2025-66614", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jni@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:5b8bc824-d1d4-5eae-a080-cf6602e6efe9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66614 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jni." } }, { "id": "CVE-2026-24733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jni@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:bcaa5310-a4a3-5157-986f-0e874a9d7c4f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24733 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jni." } }, { "id": "CVE-2026-24734", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jni@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:1e89c210-2aee-5f12-8553-a91b42605ad6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24734 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jni." } }, { "id": "CVE-2026-24880", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jni@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:21d1acdf-46de-59d5-8ca6-7136a19a8df7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24880 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jni." } }, { "id": "CVE-2026-25854", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jni@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:e750e636-8607-5866-842c-adc473a05a45", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25854 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jni." } }, { "id": "CVE-2026-29145", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jni@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:76ec524c-93de-521b-b36b-e41fc3b91651", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29145 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jni." } }, { "id": "CVE-2026-29146", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jni@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:1f1ece9f-2ffa-5671-87a0-d3a112c02cc7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29146 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jni." } }, { "id": "CVE-2026-32990", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jni@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:eaf55e40-1064-5c6b-8bb9-93ab826a8847", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-32990 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jni. not_affected \u2014 Apache Tomcat 10.1.16 is not affected by CVE-2026-32990. The vulnerability exists in the checkSni() method's incomplete fix for CVE-2025-66614, affecting versions 10.1.50-10.1.52. Version 10.1.16 predates the introduction of the strict SNI validation feature entirely - the checkSni method, strictSni field, and protocolHostName parameter do not exist in this version. The vulnerability pattern (c...", "justification": "code_not_present" } }, { "id": "CVE-2026-34483", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jni@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:94b6abcd-69b9-581c-902f-9520e71433e6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34483 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jni." } }, { "id": "CVE-2026-34487", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jni@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:f8622fa4-6372-5809-a6ae-0d02b24b03ea", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34487 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jni." } }, { "id": "CVE-2026-41284", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jni@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:b2abb7c3-0764-54b9-a033-743e740d6cf1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41284 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jni." } }, { "id": "CVE-2026-41293", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jni@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:ad2d87d7-402e-5e9b-bc4e-2cbe6fe81b73", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41293 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jni." } }, { "id": "CVE-2026-42498", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jni@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:7bbac567-fbc5-57e1-89da-02df08264dd6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42498 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jni." } }, { "id": "CVE-2026-43512", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jni@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:a8a92f80-8802-576e-b858-4668c2268cae", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43512 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jni." } }, { "id": "CVE-2026-43513", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jni@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:177c748d-9426-5f56-83eb-5fe27ab463ba", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43513 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jni." } }, { "id": "CVE-2026-43514", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jni@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:c0ed6e78-b10f-5b66-bc70-3d8f78fefccf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43514 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jni." } }, { "id": "CVE-2026-43515", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jni@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:f38a784b-2f6d-585e-88b3-71e48a1d970c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-43515 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jni." } }, { "id": "CVE-2026-53434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jni@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:1371b1a4-76ce-5762-a16b-b51edc0d94a2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53434 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jni." } }, { "id": "CVE-2026-65182", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jni@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:2499f3ac-b921-5019-9f4b-f8a209bd73e0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65182 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jni." } }, { "id": "CVE-2026-65905", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jni@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:ec73182c-5814-55ac-9b99-94ae628040ad", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65905 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jni." } }, { "id": "CVE-2026-68525", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jni@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:be6ae791-2cbb-527d-8a5a-b3090c91b231", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68525 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jni." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jni@10.1.16-tuxcare.1" } ] }