{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:b05d17ae-d577-5f36-a707-b91846743168", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat-jsp-api", "purl": "pkg:maven/org.apache.tomcat/tomcat-jsp-api@10.1.16-tuxcare.1", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-jsp-api@10.1.16-tuxcare.1", "version": "10.1.16-tuxcare.1", "pedigree": { "ancestors": [ { "name": "tomcat-jsp-api", "purl": "pkg:maven/org.apache.tomcat/tomcat-jsp-api@10.1.16", "type": "library", "group": "org.apache.tomcat", "version": "10.1.16" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-23672", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jsp-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:2a4c2fe3-7399-56c4-bd35-ef4c2d14e909", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-23672 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jsp-api." } }, { "id": "CVE-2024-24549", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jsp-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:6cca510b-3ff3-56dd-a3b5-b6c50b77d30f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-24549 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jsp-api." } }, { "id": "CVE-2024-34750", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jsp-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:323a9333-6c03-5bca-96b8-9b4bc1e41de2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34750 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jsp-api." } }, { "id": "CVE-2024-38286", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jsp-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:a39401d7-e83b-5a5c-ae08-021129516bc2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38286 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jsp-api." } }, { "id": "CVE-2024-50379", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jsp-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:770fd91a-976d-52ed-92f3-c46b9efe755c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-50379 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jsp-api." } }, { "id": "CVE-2024-52316", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jsp-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:e083ac67-571a-508a-82d5-ca37e1e67155", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-52316 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jsp-api." } }, { "id": "CVE-2024-54677", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jsp-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:0b9aae5f-fc2d-5703-9f4f-8ae2ca0f8dbe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-54677 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jsp-api." } }, { "id": "CVE-2024-56337", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jsp-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:cc59d54f-cbb5-5bd2-81cb-edf48fc14fec", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-56337 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jsp-api." } }, { "id": "CVE-2025-24813", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jsp-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:4ecb1afa-4148-53d6-906f-269c9b3f4012", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-24813 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jsp-api." } }, { "id": "CVE-2025-31650", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jsp-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:8b609229-504e-590d-b289-88e75ac12b8b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31650 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jsp-api." } }, { "id": "CVE-2025-31651", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jsp-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:cf87592d-6344-5d75-903d-26cf7ec7840a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31651 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jsp-api." } }, { "id": "CVE-2025-46701", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jsp-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:ee081d13-d8d4-5f19-beea-1204ce197bc9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-46701 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jsp-api." } }, { "id": "CVE-2025-48988", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jsp-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:0b3708bb-5379-5f97-b131-cd1c5ef3aefe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-48988 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jsp-api." } }, { "id": "CVE-2025-48989", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jsp-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:9d4d9698-bee2-5181-a27d-83055eb4c819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48989 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jsp-api." } }, { "id": "CVE-2025-49124", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jsp-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:ef35ee18-9310-5c0a-9f55-de1336332a4a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49124 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jsp-api." } }, { "id": "CVE-2025-49125", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jsp-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:e6b48c81-1398-5145-b96a-6041dcc15a2d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49125 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jsp-api." } }, { "id": "CVE-2025-52520", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jsp-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:10508d7f-8be1-506b-b048-2757304ceaff", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-52520 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jsp-api." } }, { "id": "CVE-2025-53506", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jsp-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:0130a5ae-4bc0-594b-8cc8-42cbd2500868", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-53506 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jsp-api." } }, { "id": "CVE-2025-55668", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jsp-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:5ad2275f-b5fe-590b-86c6-7d2fbf302c02", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55668 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jsp-api." } }, { "id": "CVE-2025-55752", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jsp-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:111dfb22-0ee8-5e6e-9705-aec81828786f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-55752 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jsp-api. Version 10.1.16 is NOT vulnerable to CVE-2025-55752. The vulnerable code pattern (normalizing before decoding in RewriteValve) was introduced later in version 10.1.40. Version 10.1.16 uses a different code structure that does not call URLDecoder.decode after RequestUtil.normalize, thus the vulnerability is not present. The CVE advisory's version range \"10.1.0-M1 through 10.1.44\" is over-broad; only versions 10.1.40-10.1.44 contain the vulnerable pattern.", "justification": "code_not_present" } }, { "id": "CVE-2025-55754", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jsp-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:a45e2f68-abc1-5520-9316-d0b9e3685d06", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55754 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jsp-api." } }, { "id": "CVE-2025-61795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jsp-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:391e56c8-1443-56ac-a15f-f08e92e16ed0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-61795 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jsp-api." } }, { "id": "CVE-2025-66614", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jsp-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:a79381c5-2fa0-54b4-830f-81d9bd007fd6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66614 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jsp-api." } }, { "id": "CVE-2026-24733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jsp-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:1b73333d-e056-59c7-b9ef-e13afbcbc6eb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24733 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jsp-api." } }, { "id": "CVE-2026-24734", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jsp-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:f8e830d1-10e8-5475-b164-cb2a1f966434", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24734 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jsp-api." } }, { "id": "CVE-2026-24880", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jsp-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:c8874ee9-9ffb-54d4-a123-a280650f2d3a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24880 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jsp-api." } }, { "id": "CVE-2026-25854", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jsp-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:9eb0e70a-48da-59aa-979d-d5240cb68276", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25854 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jsp-api." } }, { "id": "CVE-2026-29145", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jsp-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:c2e2b8da-cd86-571b-96f7-0b3e9e5d041b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29145 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jsp-api." } }, { "id": "CVE-2026-29146", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jsp-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:14351912-1bb4-5b24-8f2a-7efa0a113eb3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29146 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jsp-api." } }, { "id": "CVE-2026-32990", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jsp-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:6a5bf1ba-4b45-5128-9ea1-6c5c9a09fb9a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-32990 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jsp-api. not_affected \u2014 Apache Tomcat 10.1.16 is not affected by CVE-2026-32990. The vulnerability exists in the checkSni() method's incomplete fix for CVE-2025-66614, affecting versions 10.1.50-10.1.52. Version 10.1.16 predates the introduction of the strict SNI validation feature entirely - the checkSni method, strictSni field, and protocolHostName parameter do not exist in this version. The vulnerability pattern (c...", "justification": "code_not_present" } }, { "id": "CVE-2026-34483", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jsp-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:e3dfcc88-f144-5fe2-8e95-c276c1689f4b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34483 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jsp-api." } }, { "id": "CVE-2026-34487", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jsp-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:e322c923-7e32-52e4-a034-4ffad7fa039c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34487 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jsp-api." } }, { "id": "CVE-2026-41284", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jsp-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:662adff4-52b1-5120-881a-e86b05939d32", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41284 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jsp-api." } }, { "id": "CVE-2026-41293", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jsp-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:dbdb8f39-329d-5bf0-891b-3e7377a4e381", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41293 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jsp-api." } }, { "id": "CVE-2026-42498", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jsp-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:66941b14-95aa-5337-82ec-dab9e75d27db", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42498 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jsp-api." } }, { "id": "CVE-2026-43512", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jsp-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:31031065-3946-5a10-9ff5-37137248fdcf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43512 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jsp-api." } }, { "id": "CVE-2026-43513", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jsp-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:48bf1dda-021b-5ede-9787-0c57b8db91b2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43513 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jsp-api." } }, { "id": "CVE-2026-43514", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jsp-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:9f6c3827-47e8-5952-ab4c-96070447d1a6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43514 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jsp-api." } }, { "id": "CVE-2026-43515", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jsp-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:54ebb1ad-b4ad-562e-8881-04cafe8cf3a6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-43515 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jsp-api." } }, { "id": "CVE-2026-53434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jsp-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:4039611c-0e32-57c2-895d-36f1f1006cfa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53434 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jsp-api." } }, { "id": "CVE-2026-65182", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jsp-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:641d351e-ae81-5170-bec1-ecdec2214961", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65182 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jsp-api." } }, { "id": "CVE-2026-65905", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jsp-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:79a99d3b-3255-5965-97f9-0edf9294b0b0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65905 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jsp-api." } }, { "id": "CVE-2026-68525", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jsp-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:e6938631-9447-522b-9a55-f8d9365569fb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68525 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-jsp-api." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jsp-api@10.1.16-tuxcare.1" } ] }