{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:3b6a34ed-0792-5896-95c5-c3ace273df1d", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat-util-scan", "purl": "pkg:maven/org.apache.tomcat/tomcat-util-scan@10.1.16-tuxcare.1", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-util-scan@10.1.16-tuxcare.1", "version": "10.1.16-tuxcare.1", "pedigree": { "ancestors": [ { "name": "tomcat-util-scan", "purl": "pkg:maven/org.apache.tomcat/tomcat-util-scan@10.1.16", "type": "library", "group": "org.apache.tomcat", "version": "10.1.16" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-23672", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util-scan@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:ce090b32-8682-565a-9fcf-5d952def8502", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-23672 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util-scan." } }, { "id": "CVE-2024-24549", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util-scan@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:35dbd8e3-cd55-5af4-9c3c-4605c9dc2c1f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-24549 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util-scan." } }, { "id": "CVE-2024-34750", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util-scan@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:7d4dec6e-e426-5f3d-8dae-991f5209f4a5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34750 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util-scan." } }, { "id": "CVE-2024-38286", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util-scan@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:9d12aea0-b02e-563d-bb49-fc5897af0a2f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38286 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util-scan." } }, { "id": "CVE-2024-50379", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util-scan@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:fab73f2f-8f76-534d-90a0-42ce9cfa45d1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-50379 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util-scan." } }, { "id": "CVE-2024-52316", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util-scan@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:5cb64048-4069-578a-9ac2-1090598a2100", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-52316 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util-scan." } }, { "id": "CVE-2024-54677", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util-scan@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:b42a7ef9-5342-5d54-bbf1-b1d1c0c16809", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-54677 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util-scan." } }, { "id": "CVE-2024-56337", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util-scan@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:b2651f10-a906-555b-b39b-d8abdc28d75c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-56337 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util-scan." } }, { "id": "CVE-2025-24813", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util-scan@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:36e69bab-0942-5fb1-83a4-886d8ed80598", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-24813 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util-scan." } }, { "id": "CVE-2025-31650", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util-scan@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:164aec33-ec01-5fd3-b551-a561822bda53", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31650 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util-scan." } }, { "id": "CVE-2025-31651", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util-scan@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:d3855c05-89fb-596a-8ddb-5a565f918115", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31651 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util-scan." } }, { "id": "CVE-2025-46701", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util-scan@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:4f854c9d-62a2-5c58-b878-d9b78d0b7dde", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-46701 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util-scan." } }, { "id": "CVE-2025-48988", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util-scan@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:c41a2f0b-37bc-5975-8210-76739d73e2f4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-48988 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util-scan." } }, { "id": "CVE-2025-48989", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util-scan@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:7d0afefa-264e-537d-868d-bc1a405e6c08", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48989 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util-scan." } }, { "id": "CVE-2025-49124", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util-scan@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:1b7e1f78-c2a1-5365-b5ce-c16e82ab7234", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49124 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util-scan." } }, { "id": "CVE-2025-49125", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util-scan@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:1a118876-aa36-5ae5-acae-44f761ff6521", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49125 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util-scan." } }, { "id": "CVE-2025-52520", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util-scan@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:6b1a5155-ae32-5f5d-8261-d237b0273998", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-52520 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util-scan." } }, { "id": "CVE-2025-53506", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util-scan@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:34f63566-2567-5f91-aa4e-e27ba4c16732", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-53506 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util-scan." } }, { "id": "CVE-2025-55668", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util-scan@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:0abce8c5-3e7d-55e8-bbd3-9d954af75e31", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55668 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util-scan." } }, { "id": "CVE-2025-55752", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util-scan@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:75cc1c96-0dc6-52b0-80f4-37d0c3ad90e8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-55752 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util-scan. Version 10.1.16 is NOT vulnerable to CVE-2025-55752. The vulnerable code pattern (normalizing before decoding in RewriteValve) was introduced later in version 10.1.40. Version 10.1.16 uses a different code structure that does not call URLDecoder.decode after RequestUtil.normalize, thus the vulnerability is not present. The CVE advisory's version range \"10.1.0-M1 through 10.1.44\" is over-broad; only versions 10.1.40-10.1.44 contain the vulnerable pattern.", "justification": "code_not_present" } }, { "id": "CVE-2025-55754", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util-scan@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:5b32c1e7-8d39-5b00-85e7-649afd08f042", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55754 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util-scan." } }, { "id": "CVE-2025-61795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util-scan@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:f991ecfb-c20d-58f7-9df8-841a318e8df7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-61795 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util-scan." } }, { "id": "CVE-2025-66614", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util-scan@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:84571ca2-a49d-5e34-933e-c02d9cf70d93", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66614 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util-scan." } }, { "id": "CVE-2026-24733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util-scan@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:74b41c4c-db3a-570d-85fe-62665012cf40", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24733 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util-scan." } }, { "id": "CVE-2026-24734", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util-scan@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:d4a5f0ce-6c40-52c9-8bf8-fe6f964c0379", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24734 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util-scan." } }, { "id": "CVE-2026-24880", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util-scan@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:18336585-e898-59b2-a36d-dd012057c5d2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24880 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util-scan." } }, { "id": "CVE-2026-25854", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util-scan@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:866b0453-d849-509b-8b55-447a5c9fa035", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25854 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util-scan." } }, { "id": "CVE-2026-29145", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util-scan@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:9933ff3a-681c-5e20-b781-dbac89ffb28a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29145 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util-scan." } }, { "id": "CVE-2026-29146", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util-scan@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:f8d1feb3-a837-5f41-a94d-73afd55e21da", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29146 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util-scan." } }, { "id": "CVE-2026-32990", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util-scan@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:ac4e28c5-8a9a-51e5-b08a-ab9cb27e330d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-32990 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util-scan. not_affected \u2014 Apache Tomcat 10.1.16 is not affected by CVE-2026-32990. The vulnerability exists in the checkSni() method's incomplete fix for CVE-2025-66614, affecting versions 10.1.50-10.1.52. Version 10.1.16 predates the introduction of the strict SNI validation feature entirely - the checkSni method, strictSni field, and protocolHostName parameter do not exist in this version. The vulnerability pattern (c...", "justification": "code_not_present" } }, { "id": "CVE-2026-34483", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util-scan@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:0dde4d4a-e8aa-585c-b8c6-31213ca6333b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34483 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util-scan." } }, { "id": "CVE-2026-34487", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util-scan@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:d99dc4ad-6e9b-5ceb-8eb5-6db3f13374a6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34487 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util-scan." } }, { "id": "CVE-2026-41284", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util-scan@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:46d09f25-254a-5677-909f-45b245df31a6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41284 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util-scan." } }, { "id": "CVE-2026-41293", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util-scan@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:7776f03f-43c0-5a91-adec-4558c1cb4a18", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41293 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util-scan." } }, { "id": "CVE-2026-42498", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util-scan@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:f731b0f3-747c-5512-a22a-2607d0f98381", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42498 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util-scan." } }, { "id": "CVE-2026-43512", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util-scan@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:0eb390f2-f7d7-52bc-a58f-1441bef8b180", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43512 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util-scan." } }, { "id": "CVE-2026-43513", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util-scan@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:eb12e28d-8213-56b1-a602-c98dbadb0370", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43513 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util-scan." } }, { "id": "CVE-2026-43514", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util-scan@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:0f6de3aa-d2a2-5fdb-8182-330ccde52dbb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43514 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util-scan." } }, { "id": "CVE-2026-43515", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util-scan@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:66a19bc5-94f2-5feb-9838-c058ee87571f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-43515 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util-scan." } }, { "id": "CVE-2026-53434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util-scan@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:38abc2f6-d1f9-53f4-918b-7a8b9538a48f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53434 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util-scan." } }, { "id": "CVE-2026-65182", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util-scan@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:e838b2af-3121-5e9e-9d96-d5f1f9c854e0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65182 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util-scan." } }, { "id": "CVE-2026-65905", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util-scan@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:a73fd8cd-c268-50ce-a3da-a711f4d00eeb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65905 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util-scan." } }, { "id": "CVE-2026-68525", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util-scan@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:054b9fe7-72cd-5a02-bfba-8a34c6b3bf88", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68525 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util-scan." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util-scan@10.1.16-tuxcare.1" } ] }