{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:2f2b0486-615b-53e6-b82e-a4056540c89c", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat-tribes", "purl": "pkg:maven/org.apache.tomcat/tomcat-tribes@10.1.16-tuxcare.1", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-tribes@10.1.16-tuxcare.1", "version": "10.1.16-tuxcare.1", "pedigree": { "ancestors": [ { "name": "tomcat-tribes", "purl": "pkg:maven/org.apache.tomcat/tomcat-tribes@10.1.16", "type": "library", "group": "org.apache.tomcat", "version": "10.1.16" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-23672", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-tribes@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:c97815f1-859e-540d-b4b1-d9ecdca39126", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-23672 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-tribes." } }, { "id": "CVE-2024-24549", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-tribes@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:3a3cf7a0-c0ae-57ea-8e07-42eb3d8a869f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-24549 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-tribes." } }, { "id": "CVE-2024-34750", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-tribes@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:7a759ced-f629-5c24-9b48-6947b7409a87", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34750 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-tribes." } }, { "id": "CVE-2024-38286", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-tribes@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:7b2fc4f2-8356-57b9-818f-3a3923956e8f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38286 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-tribes." } }, { "id": "CVE-2024-50379", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-tribes@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:fc7891e7-a536-5c49-81e2-dc6e6ea201de", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-50379 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-tribes." } }, { "id": "CVE-2024-52316", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-tribes@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:7423b80e-523c-583c-bee3-4cf2afb5e2e5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-52316 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-tribes." } }, { "id": "CVE-2024-54677", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-tribes@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:ca08314e-af9c-5179-8bdc-6bafa1c3bdf8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-54677 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-tribes." } }, { "id": "CVE-2024-56337", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-tribes@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:0a9b2304-5897-5c68-8ec0-1159d3f61d2a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-56337 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-tribes." } }, { "id": "CVE-2025-24813", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-tribes@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:71d1528b-e743-565b-ba77-0ea5eb2942c0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-24813 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-tribes." } }, { "id": "CVE-2025-31650", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-tribes@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:2cc2150e-8e86-572a-a6d4-ad3ebcb0dc10", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31650 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-tribes." } }, { "id": "CVE-2025-31651", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-tribes@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:a0089f14-c7c8-57ce-95d8-6065ae16ad9d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31651 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-tribes." } }, { "id": "CVE-2025-46701", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-tribes@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:ba285cbf-713e-524f-ac37-80b008a9f6c9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-46701 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-tribes." } }, { "id": "CVE-2025-48988", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-tribes@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:8629e574-397b-5e7b-9040-f65546ea21a2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-48988 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-tribes." } }, { "id": "CVE-2025-48989", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-tribes@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:d56cbd69-c8cd-5ee2-97e2-af1a2c32f87c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48989 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-tribes." } }, { "id": "CVE-2025-49124", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-tribes@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:b02423f0-2404-504b-a207-c87abadc39fa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49124 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-tribes." } }, { "id": "CVE-2025-49125", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-tribes@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:25fb6015-5e6d-577a-be50-995311683df0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49125 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-tribes." } }, { "id": "CVE-2025-52520", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-tribes@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:8d0e6f9a-2952-547a-a5e7-3e51e859c4f9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-52520 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-tribes." } }, { "id": "CVE-2025-53506", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-tribes@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:6f0ceb4e-82ba-5897-b00d-29556d2af3ea", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-53506 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-tribes." } }, { "id": "CVE-2025-55668", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-tribes@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:af976c66-bb8a-569b-89fe-f5f8918cac1f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55668 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-tribes." } }, { "id": "CVE-2025-55752", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-tribes@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:594e5cd7-9f92-5de0-af0d-9d64f9ef12af", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-55752 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-tribes. Version 10.1.16 is NOT vulnerable to CVE-2025-55752. The vulnerable code pattern (normalizing before decoding in RewriteValve) was introduced later in version 10.1.40. Version 10.1.16 uses a different code structure that does not call URLDecoder.decode after RequestUtil.normalize, thus the vulnerability is not present. The CVE advisory's version range \"10.1.0-M1 through 10.1.44\" is over-broad; only versions 10.1.40-10.1.44 contain the vulnerable pattern.", "justification": "code_not_present" } }, { "id": "CVE-2025-55754", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-tribes@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:61bfb220-633f-513f-89ad-259761b00cb0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55754 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-tribes." } }, { "id": "CVE-2025-61795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-tribes@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:cb9dbe3f-5069-5d7f-9ffc-7a3733a251c3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-61795 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-tribes." } }, { "id": "CVE-2025-66614", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-tribes@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:171c802c-4d16-5b66-8e1a-24a7ca2f6322", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66614 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-tribes." } }, { "id": "CVE-2026-24733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-tribes@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:443cc907-7f2f-5b36-91fd-8365d58dd9e6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24733 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-tribes." } }, { "id": "CVE-2026-24734", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-tribes@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:9b1a3029-6fc5-5efa-b137-688d5465ab1f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24734 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-tribes." } }, { "id": "CVE-2026-24880", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-tribes@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:ff435b1e-6022-56bf-9efe-3907f5cb8653", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24880 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-tribes." } }, { "id": "CVE-2026-25854", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-tribes@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:063a0c4e-ddc7-56ea-88ba-eab83b4a6d48", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25854 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-tribes." } }, { "id": "CVE-2026-29145", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-tribes@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:ee1a1f26-7896-509f-9fdb-7f3e3f97b528", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29145 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-tribes." } }, { "id": "CVE-2026-29146", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-tribes@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:a2c98500-ada3-5bd0-a10d-e8c16e0e81db", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29146 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-tribes." } }, { "id": "CVE-2026-32990", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-tribes@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:4e8f4e81-f564-57b9-a1f0-5c79fee80e5e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-32990 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-tribes. not_affected \u2014 Apache Tomcat 10.1.16 is not affected by CVE-2026-32990. The vulnerability exists in the checkSni() method's incomplete fix for CVE-2025-66614, affecting versions 10.1.50-10.1.52. Version 10.1.16 predates the introduction of the strict SNI validation feature entirely - the checkSni method, strictSni field, and protocolHostName parameter do not exist in this version. The vulnerability pattern (c...", "justification": "code_not_present" } }, { "id": "CVE-2026-34483", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-tribes@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:32822f60-3b1b-5af2-b8cd-fab3ab15598b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34483 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-tribes." } }, { "id": "CVE-2026-34487", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-tribes@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:dbbe7d66-dded-5ed4-9084-13d7d98f4377", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34487 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-tribes." } }, { "id": "CVE-2026-41284", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-tribes@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:8618725a-3a83-512a-b346-3576d5ea08b1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41284 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-tribes." } }, { "id": "CVE-2026-41293", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-tribes@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:790e1666-381a-5ed3-a18e-d3bd36c89976", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41293 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-tribes." } }, { "id": "CVE-2026-42498", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-tribes@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:edc43469-3891-5941-a9e7-5269572f1fa1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42498 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-tribes." } }, { "id": "CVE-2026-43512", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-tribes@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:bdc0d057-e37f-53d7-93c4-f935911c2250", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43512 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-tribes." } }, { "id": "CVE-2026-43513", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-tribes@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:001a78c5-77c8-53da-8d39-3a7e95f8ae74", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43513 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-tribes." } }, { "id": "CVE-2026-43514", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-tribes@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:59899f0c-524f-5aa5-9010-59d35fd1313f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43514 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-tribes." } }, { "id": "CVE-2026-43515", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-tribes@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:bc58436f-64dd-5a8f-9a69-76bdf1301d90", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-43515 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-tribes." } }, { "id": "CVE-2026-53434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-tribes@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:85d77978-b2a9-5f49-a7cb-e363362cfb57", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53434 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-tribes." } }, { "id": "CVE-2026-65182", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-tribes@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:34b7b11a-a85f-5f42-8b16-60edffa909a6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65182 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-tribes." } }, { "id": "CVE-2026-65905", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-tribes@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:04aa9aa0-7472-5d57-84c4-5f1aec675834", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65905 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-tribes." } }, { "id": "CVE-2026-68525", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-tribes@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:dfd4b98d-2962-595e-b6d7-e10294223cce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68525 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-tribes." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-tribes@10.1.16-tuxcare.1" } ] }