{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:d347c30f-05e4-5025-9589-8c201f2202cf", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat-util", "purl": "pkg:maven/org.apache.tomcat/tomcat-util@10.1.16-tuxcare.1", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-util@10.1.16-tuxcare.1", "version": "10.1.16-tuxcare.1", "pedigree": { "ancestors": [ { "name": "tomcat-util", "purl": "pkg:maven/org.apache.tomcat/tomcat-util@10.1.16", "type": "library", "group": "org.apache.tomcat", "version": "10.1.16" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-23672", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:e0bad5a6-da52-5c78-827e-296e291727c3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-23672 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util." } }, { "id": "CVE-2024-24549", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:c26829ec-3a8a-5fb1-87ed-68d09bbdb492", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-24549 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util." } }, { "id": "CVE-2024-34750", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:2670baed-b601-5b07-8ceb-1351fe1b49e6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34750 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util." } }, { "id": "CVE-2024-38286", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:907e5ac4-234e-57ac-960d-ddc09d28dbf9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38286 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util." } }, { "id": "CVE-2024-50379", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:af6387a0-1eef-5282-8f5f-5e1d087aff38", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-50379 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util." } }, { "id": "CVE-2024-52316", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:3b3b56c8-5f92-5444-b563-8682b1aa9926", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-52316 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util." } }, { "id": "CVE-2024-54677", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:d8c1ff81-115f-5a22-8067-d684467de197", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-54677 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util." } }, { "id": "CVE-2024-56337", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:7af95379-3151-51eb-b44a-6b1dfc9962eb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-56337 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util." } }, { "id": "CVE-2025-24813", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:81b7e3f4-8378-572c-b042-8ea6b722c25a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-24813 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util." } }, { "id": "CVE-2025-31650", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:c13c21b5-a038-5841-b0c5-bd60fd77270a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31650 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util." } }, { "id": "CVE-2025-31651", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:8891a8ac-39a7-548d-8976-5160acb349f9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31651 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util." } }, { "id": "CVE-2025-46701", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:0669969e-3cfb-5196-b8f3-1c64b38e3ee2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-46701 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util." } }, { "id": "CVE-2025-48988", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:52ed3dc1-5a6c-5139-8b9b-202a895abb0a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-48988 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util." } }, { "id": "CVE-2025-48989", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:334c279a-f59c-5e2f-8c36-02d03dc06310", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48989 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util." } }, { "id": "CVE-2025-49124", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:47a82c81-68e1-5fc7-9b82-b4fd293219d0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49124 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util." } }, { "id": "CVE-2025-49125", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:4afd5780-ac1f-50c5-b840-6caf9328da26", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49125 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util." } }, { "id": "CVE-2025-52520", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:36b0969f-e2c5-530b-bf6e-6f925f058b98", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-52520 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util." } }, { "id": "CVE-2025-53506", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:a7f39916-5945-513e-b0de-97ad451d19a8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-53506 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util." } }, { "id": "CVE-2025-55668", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:4c71448a-bdde-5ef0-bbc1-fcdb77539d05", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55668 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util." } }, { "id": "CVE-2025-55752", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:a10d6b2f-647a-5e94-9956-3865222d9832", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-55752 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util. Version 10.1.16 is NOT vulnerable to CVE-2025-55752. The vulnerable code pattern (normalizing before decoding in RewriteValve) was introduced later in version 10.1.40. Version 10.1.16 uses a different code structure that does not call URLDecoder.decode after RequestUtil.normalize, thus the vulnerability is not present. The CVE advisory's version range \"10.1.0-M1 through 10.1.44\" is over-broad; only versions 10.1.40-10.1.44 contain the vulnerable pattern.", "justification": "code_not_present" } }, { "id": "CVE-2025-55754", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:b89b12bb-565d-5ec6-848a-f44d03611ab7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55754 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util." } }, { "id": "CVE-2025-61795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:6e5bf7b5-474a-5daa-96e4-b39de954b0d3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-61795 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util." } }, { "id": "CVE-2025-66614", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:b4923cb9-d994-503c-9c35-2ed991359d83", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66614 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util." } }, { "id": "CVE-2026-24733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:fbe02ec8-b374-5669-90cd-9e6e05e9b2e1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24733 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util." } }, { "id": "CVE-2026-24734", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:23b26042-9681-5a66-ad83-84dcb2eb3328", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24734 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util." } }, { "id": "CVE-2026-24880", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:1cbeb598-1844-5c8b-8814-1e3c5939be38", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24880 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util." } }, { "id": "CVE-2026-25854", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:e80166b5-d365-5ef8-9ad5-7f76cd505143", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25854 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util." } }, { "id": "CVE-2026-29145", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:33fa3141-5d0b-58e5-8fab-bc706f573dbf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29145 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util." } }, { "id": "CVE-2026-29146", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:da044655-ee5c-5b0e-ac9c-a1f3aa081889", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29146 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util." } }, { "id": "CVE-2026-32990", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:b616a0bb-6b72-5d4a-a4cd-1dfb5daabbf2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-32990 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util. not_affected \u2014 Apache Tomcat 10.1.16 is not affected by CVE-2026-32990. The vulnerability exists in the checkSni() method's incomplete fix for CVE-2025-66614, affecting versions 10.1.50-10.1.52. Version 10.1.16 predates the introduction of the strict SNI validation feature entirely - the checkSni method, strictSni field, and protocolHostName parameter do not exist in this version. The vulnerability pattern (c...", "justification": "code_not_present" } }, { "id": "CVE-2026-34483", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:f3debd6a-312a-5f72-a577-b8ac908799d0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34483 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util." } }, { "id": "CVE-2026-34487", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:b4091b31-3733-536e-a021-97da69b90b2e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34487 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util." } }, { "id": "CVE-2026-41284", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:67174c7c-434f-5e6e-a548-5fb03a8e1030", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41284 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util." } }, { "id": "CVE-2026-41293", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:00501ac0-5616-5b12-830a-0ec659201a68", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41293 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util." } }, { "id": "CVE-2026-42498", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:ca661737-337c-5598-9585-3024e024ee4e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42498 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util." } }, { "id": "CVE-2026-43512", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:01635580-7e25-5efe-bd71-e65c949ac5ea", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43512 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util." } }, { "id": "CVE-2026-43513", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:e431f87a-592a-5a4a-b9f6-6d59693f7da1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43513 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util." } }, { "id": "CVE-2026-43514", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:0f4311ea-1d5c-52b2-b05d-b4a41e914f02", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43514 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util." } }, { "id": "CVE-2026-43515", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:3e5a22f4-e6b3-5f4a-98ba-f6fc68c73388", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-43515 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util." } }, { "id": "CVE-2026-53434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:9cd65b48-9e6c-52d1-8e60-4452c70a6a42", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53434 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util." } }, { "id": "CVE-2026-65182", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:83b01f9b-2921-5865-8c52-84d1fd73a1c4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65182 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util." } }, { "id": "CVE-2026-65905", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:2542ebf4-b115-5ede-a3b0-879171a77df0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65905 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util." } }, { "id": "CVE-2026-68525", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:e85a7da6-7a25-5680-ba8b-8d90ff879ac3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68525 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-util." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-util@10.1.16-tuxcare.1" } ] }