{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:b4a99922-4154-522b-aaa6-7acf94fa2c7e", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat-juli", "purl": "pkg:maven/org.apache.tomcat/tomcat-juli@10.1.16-tuxcare.1", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-juli@10.1.16-tuxcare.1", "version": "10.1.16-tuxcare.1", "pedigree": { "ancestors": [ { "name": "tomcat-juli", "purl": "pkg:maven/org.apache.tomcat/tomcat-juli@10.1.16", "type": "library", "group": "org.apache.tomcat", "version": "10.1.16" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-23672", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-juli@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:52141d08-9e92-59e9-bc3d-146cc2f0e4c9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-23672 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-juli." } }, { "id": "CVE-2024-24549", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-juli@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:63a1c70a-d869-526b-a378-e810e09d2335", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-24549 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-juli." } }, { "id": "CVE-2024-34750", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-juli@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:85a64cea-64fc-5c7e-9320-128058f29d99", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34750 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-juli." } }, { "id": "CVE-2024-38286", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-juli@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:720c0bf4-6f7e-5989-a90b-963f34ffc4ea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38286 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-juli." } }, { "id": "CVE-2024-50379", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-juli@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:ac65689e-ae2b-5002-a91b-7e539235658c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-50379 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-juli." } }, { "id": "CVE-2024-52316", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-juli@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:030fffbf-18b3-5707-9bca-ee290e53743d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-52316 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-juli." } }, { "id": "CVE-2024-54677", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-juli@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:0285a03b-7bff-5b7a-9f7d-9dbc1c997672", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-54677 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-juli." } }, { "id": "CVE-2024-56337", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-juli@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:ecd94fbc-5583-5fac-83b2-8ea575551d0b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-56337 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-juli." } }, { "id": "CVE-2025-24813", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-juli@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:a69c1cd2-e49e-5b1f-a1d3-a0da961a3f05", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-24813 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-juli." } }, { "id": "CVE-2025-31650", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-juli@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:553936c0-123b-5525-a69b-dae7b3d816cd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31650 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-juli." } }, { "id": "CVE-2025-31651", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-juli@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:21cebd62-ef15-53d9-88ae-7243d5e21192", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31651 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-juli." } }, { "id": "CVE-2025-46701", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-juli@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:8db8193d-37ae-5554-a78d-7e3db04e26ab", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-46701 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-juli." } }, { "id": "CVE-2025-48988", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-juli@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:ccfcf7af-899d-5630-8b1a-306718ed1c87", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-48988 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-juli." } }, { "id": "CVE-2025-48989", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-juli@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:48610894-7f7c-5d1c-b4e8-c7c00b019dfb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48989 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-juli." } }, { "id": "CVE-2025-49124", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-juli@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:5ca2ee3d-f0a1-5693-9fb1-fa79bff57489", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49124 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-juli." } }, { "id": "CVE-2025-49125", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-juli@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:36ee611e-453b-50dc-95e5-42438528d925", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49125 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-juli." } }, { "id": "CVE-2025-52520", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-juli@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:4f475efb-be8b-5636-8d37-b96c5b304538", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-52520 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-juli." } }, { "id": "CVE-2025-53506", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-juli@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:253d6171-6563-50df-9fb3-124f16305380", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-53506 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-juli." } }, { "id": "CVE-2025-55668", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-juli@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:39cace8b-3ad5-5d03-ba87-4397010eddf9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55668 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-juli." } }, { "id": "CVE-2025-55752", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-juli@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:a5f6ce94-f553-5fa5-bbec-00fd928841b7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-55752 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-juli. Version 10.1.16 is NOT vulnerable to CVE-2025-55752. The vulnerable code pattern (normalizing before decoding in RewriteValve) was introduced later in version 10.1.40. Version 10.1.16 uses a different code structure that does not call URLDecoder.decode after RequestUtil.normalize, thus the vulnerability is not present. The CVE advisory's version range \"10.1.0-M1 through 10.1.44\" is over-broad; only versions 10.1.40-10.1.44 contain the vulnerable pattern.", "justification": "code_not_present" } }, { "id": "CVE-2025-55754", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-juli@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:0011fcb9-14b1-5c94-a0c2-acb0112788f4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55754 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-juli." } }, { "id": "CVE-2025-61795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-juli@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:684b58db-d017-52d9-89eb-c2bb9c52cf70", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-61795 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-juli." } }, { "id": "CVE-2025-66614", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-juli@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:69e44b2a-d204-56d8-a229-bca17de59db8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66614 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-juli." } }, { "id": "CVE-2026-24733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-juli@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:753e6f50-95f7-5d85-95e9-a7b8283c1912", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24733 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-juli." } }, { "id": "CVE-2026-24734", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-juli@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:b306f56c-371f-5c88-b346-466189695ad4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24734 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-juli." } }, { "id": "CVE-2026-24880", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-juli@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:6650417f-40ba-5e23-8a97-550f8b5f9d0a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24880 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-juli." } }, { "id": "CVE-2026-25854", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-juli@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:0dd14bac-9383-53a9-a85c-6ef07ac27799", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25854 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-juli." } }, { "id": "CVE-2026-29145", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-juli@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:34f1c29f-93b7-581f-84ae-f2bdaacdba1a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29145 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-juli." } }, { "id": "CVE-2026-29146", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-juli@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:f055e930-0d4a-5f22-b7b0-239b51420677", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29146 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-juli." } }, { "id": "CVE-2026-32990", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-juli@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:09e24265-6b98-5f0b-ac32-676a06ea24bd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-32990 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-juli. not_affected \u2014 Apache Tomcat 10.1.16 is not affected by CVE-2026-32990. The vulnerability exists in the checkSni() method's incomplete fix for CVE-2025-66614, affecting versions 10.1.50-10.1.52. Version 10.1.16 predates the introduction of the strict SNI validation feature entirely - the checkSni method, strictSni field, and protocolHostName parameter do not exist in this version. The vulnerability pattern (c...", "justification": "code_not_present" } }, { "id": "CVE-2026-34483", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-juli@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:f535a994-0bbd-5578-b792-c8df2ade3424", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34483 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-juli." } }, { "id": "CVE-2026-34487", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-juli@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:8a4cb618-ddbc-5ab8-9e39-8e616f9aaa83", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34487 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-juli." } }, { "id": "CVE-2026-41284", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-juli@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:75f89426-6fb5-5c51-80a0-179962915928", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41284 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-juli." } }, { "id": "CVE-2026-41293", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-juli@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:e6f1df95-bcf2-5737-a4bb-0a4c4cb788bd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41293 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-juli." } }, { "id": "CVE-2026-42498", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-juli@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:7b13a9ff-b278-5f77-acbf-ea36b55a79fd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42498 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-juli." } }, { "id": "CVE-2026-43512", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-juli@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:c1428636-0855-537f-be67-0801c0369f3c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43512 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-juli." } }, { "id": "CVE-2026-43513", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-juli@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:1a0a478b-26f0-5024-8fc6-eb4350071e98", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43513 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-juli." } }, { "id": "CVE-2026-43514", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-juli@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:89c29439-1475-5d44-a125-3cb61592115d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43514 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-juli." } }, { "id": "CVE-2026-43515", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-juli@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:21ba3fa3-a1cd-52af-a1f3-257145a3035b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-43515 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-juli." } }, { "id": "CVE-2026-53434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-juli@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:979b43e4-cfcc-526e-b3ef-057ace677cfa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53434 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-juli." } }, { "id": "CVE-2026-65182", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-juli@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:819ffc3c-db69-52bf-958b-c5438a63107c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65182 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-juli." } }, { "id": "CVE-2026-65905", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-juli@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:5e89ca86-3160-510f-a08b-0eec2a113cd8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65905 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-juli." } }, { "id": "CVE-2026-68525", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-juli@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:bbc97702-b1e0-5d78-9955-4e04f7c051b2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68525 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-juli." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-juli@10.1.16-tuxcare.1" } ] }