{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:4d0a5987-77fc-5673-a0c4-60219a468c14", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat-servlet-api", "purl": "pkg:maven/org.apache.tomcat/tomcat-servlet-api@10.1.16-tuxcare.1", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-servlet-api@10.1.16-tuxcare.1", "version": "10.1.16-tuxcare.1", "pedigree": { "ancestors": [ { "name": "tomcat-servlet-api", "purl": "pkg:maven/org.apache.tomcat/tomcat-servlet-api@10.1.16", "type": "library", "group": "org.apache.tomcat", "version": "10.1.16" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-23672", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-servlet-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:53fcf249-b9cb-5f74-a70a-226e8ba5b5f5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-23672 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-servlet-api." } }, { "id": "CVE-2024-24549", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-servlet-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:2da70ab5-604f-5e87-8f4d-664aee3d0ea2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-24549 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-servlet-api." } }, { "id": "CVE-2024-34750", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-servlet-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:2a1f5b8c-5164-5e0e-93e7-152e62fd5da8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34750 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-servlet-api." } }, { "id": "CVE-2024-38286", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-servlet-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:58c0fb7b-388d-5f19-985c-7cd7f02e862e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38286 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-servlet-api." } }, { "id": "CVE-2024-50379", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-servlet-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:3636dfc9-9192-5744-afb6-6bca6e7b8b26", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-50379 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-servlet-api." } }, { "id": "CVE-2024-52316", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-servlet-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:13ee35ba-43fe-58e4-b33a-300c8da085ba", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-52316 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-servlet-api." } }, { "id": "CVE-2024-54677", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-servlet-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:a11b8c44-d7c3-554a-a09d-29cd27ef9b72", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-54677 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-servlet-api." } }, { "id": "CVE-2024-56337", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-servlet-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:2127a43b-90ea-5408-b0f0-4d9691759ebd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-56337 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-servlet-api." } }, { "id": "CVE-2025-24813", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-servlet-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:b0605493-dc02-59d0-8e74-ed0fafa06cb2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-24813 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-servlet-api." } }, { "id": "CVE-2025-31650", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-servlet-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:ade272dc-33e9-5137-a32b-e62edde7eea9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31650 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-servlet-api." } }, { "id": "CVE-2025-31651", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-servlet-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:490eb59c-1ccb-5942-8ffa-35cdf4f020b3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31651 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-servlet-api." } }, { "id": "CVE-2025-46701", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-servlet-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:75c157a0-017d-5bbd-ae95-cb13b23ce6f1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-46701 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-servlet-api." } }, { "id": "CVE-2025-48988", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-servlet-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:64378777-2a77-5d92-b697-7658047fba9d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-48988 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-servlet-api." } }, { "id": "CVE-2025-48989", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-servlet-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:31981236-bdf7-5258-b73d-43436d001804", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48989 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-servlet-api." } }, { "id": "CVE-2025-49124", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-servlet-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:4785cd5e-267b-5533-b30f-752007cbe02d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49124 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-servlet-api." } }, { "id": "CVE-2025-49125", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-servlet-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:6e92fb0d-1772-5732-92ee-1b4c92697f65", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49125 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-servlet-api." } }, { "id": "CVE-2025-52520", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-servlet-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:cb0a5f04-3534-56e8-ba99-1f212153f92e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-52520 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-servlet-api." } }, { "id": "CVE-2025-53506", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-servlet-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:ba5a6546-5bd6-5ca3-93b8-95da6cbd721c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-53506 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-servlet-api." } }, { "id": "CVE-2025-55668", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-servlet-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:38b196ea-5d28-50bb-9b31-834f254256f5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55668 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-servlet-api." } }, { "id": "CVE-2025-55752", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-servlet-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:6b3c5a8f-66f5-50cb-8396-29a4a9cb76e4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-55752 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-servlet-api. Version 10.1.16 is NOT vulnerable to CVE-2025-55752. The vulnerable code pattern (normalizing before decoding in RewriteValve) was introduced later in version 10.1.40. Version 10.1.16 uses a different code structure that does not call URLDecoder.decode after RequestUtil.normalize, thus the vulnerability is not present. The CVE advisory's version range \"10.1.0-M1 through 10.1.44\" is over-broad; only versions 10.1.40-10.1.44 contain the vulnerable pattern.", "justification": "code_not_present" } }, { "id": "CVE-2025-55754", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-servlet-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:49b590b5-8a8c-5126-9143-0e100a69863f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55754 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-servlet-api." } }, { "id": "CVE-2025-61795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-servlet-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:c27b81ed-4bde-5106-8131-909b04cbc705", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-61795 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-servlet-api." } }, { "id": "CVE-2025-66614", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-servlet-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:5ad5d567-2478-58db-bac8-c6edba6c614b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66614 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-servlet-api." } }, { "id": "CVE-2026-24733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-servlet-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:f1119633-75bc-5633-be70-5cdad2bbf6b6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24733 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-servlet-api." } }, { "id": "CVE-2026-24734", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-servlet-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:8ae7d2f2-ee7d-5257-ab86-0edced2b18af", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24734 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-servlet-api." } }, { "id": "CVE-2026-24880", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-servlet-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:9d106fc7-176a-5583-a00c-579d4597df02", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24880 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-servlet-api." } }, { "id": "CVE-2026-25854", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-servlet-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:b92bd545-4bc1-5beb-806a-b0f5e9df102b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25854 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-servlet-api." } }, { "id": "CVE-2026-29145", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-servlet-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:a15ceb36-0ddb-5337-99e6-9d8adef434b5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29145 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-servlet-api." } }, { "id": "CVE-2026-29146", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-servlet-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:0567351a-0aeb-5c07-a7da-f7b7fe7b814d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29146 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-servlet-api." } }, { "id": "CVE-2026-32990", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-servlet-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:3706403b-9208-5092-ac03-bfc9a406bc46", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-32990 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-servlet-api. not_affected \u2014 Apache Tomcat 10.1.16 is not affected by CVE-2026-32990. The vulnerability exists in the checkSni() method's incomplete fix for CVE-2025-66614, affecting versions 10.1.50-10.1.52. Version 10.1.16 predates the introduction of the strict SNI validation feature entirely - the checkSni method, strictSni field, and protocolHostName parameter do not exist in this version. The vulnerability pattern (c...", "justification": "code_not_present" } }, { "id": "CVE-2026-34483", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-servlet-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:d3b76001-9be7-573f-95e9-7b4ccf167176", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34483 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-servlet-api." } }, { "id": "CVE-2026-34487", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-servlet-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:98c86bb7-7424-599e-a8e1-baa3d6ded6bc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34487 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-servlet-api." } }, { "id": "CVE-2026-41284", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-servlet-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:3612035b-3de7-5c26-8da2-be86aa2b4a97", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41284 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-servlet-api." } }, { "id": "CVE-2026-41293", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-servlet-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:4a412f13-e6a5-5901-b453-d61bd1b18c21", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41293 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-servlet-api." } }, { "id": "CVE-2026-42498", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-servlet-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:466763bf-245d-5b9f-9d4c-3ad96d5f3d41", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42498 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-servlet-api." } }, { "id": "CVE-2026-43512", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-servlet-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:2444207a-e117-5f5d-b76e-a49a25d0e899", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43512 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-servlet-api." } }, { "id": "CVE-2026-43513", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-servlet-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:5713727b-8345-5857-9417-3674405bdc70", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43513 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-servlet-api." } }, { "id": "CVE-2026-43514", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-servlet-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:f1d4f1ab-885d-5609-91a4-c94e55273be1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43514 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-servlet-api." } }, { "id": "CVE-2026-43515", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-servlet-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:4ea72926-cc5d-5625-8147-071d3658f233", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-43515 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-servlet-api." } }, { "id": "CVE-2026-53434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-servlet-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:6a61a372-c678-5729-ba30-3d4f257a1a13", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53434 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-servlet-api." } }, { "id": "CVE-2026-65182", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-servlet-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:a8a3454a-e1f6-5ccd-8335-4b57be170314", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65182 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-servlet-api." } }, { "id": "CVE-2026-65905", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-servlet-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:c1acc624-044a-54d5-adc5-443f6b1fb7e9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65905 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-servlet-api." } }, { "id": "CVE-2026-68525", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-servlet-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:c74a28e1-86c9-59fb-9e3d-ceb667c730e9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68525 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-servlet-api." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-servlet-api@10.1.16-tuxcare.1" } ] }