{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:f3ee7278-c9e6-5e7c-b078-9e38d32c8540", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat-websocket-api", "purl": "pkg:maven/org.apache.tomcat/tomcat-websocket-api@10.1.16-tuxcare.1", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-api@10.1.16-tuxcare.1", "version": "10.1.16-tuxcare.1", "pedigree": { "ancestors": [ { "name": "tomcat-websocket-api", "purl": "pkg:maven/org.apache.tomcat/tomcat-websocket-api@10.1.16", "type": "library", "group": "org.apache.tomcat", "version": "10.1.16" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-23672", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:093f4eda-5d42-5000-bf77-77c40d02367d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-23672 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-api." } }, { "id": "CVE-2024-24549", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:431c95ef-483e-5ab2-848e-a6f69c7a6dfd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-24549 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-api." } }, { "id": "CVE-2024-34750", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:94bd1460-ca7e-5116-ad5e-cb417aa1258f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34750 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-api." } }, { "id": "CVE-2024-38286", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:5dd641fc-44e6-59a4-90ae-7f9d9458051e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38286 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-api." } }, { "id": "CVE-2024-50379", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:308b94af-c7cb-5ff2-b739-895c43237d5b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-50379 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-api." } }, { "id": "CVE-2024-52316", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:7383c90a-9904-5b83-a463-1df74b57ec83", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-52316 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-api." } }, { "id": "CVE-2024-54677", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:390380b8-4ac6-5527-b661-269afd29ecdd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-54677 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-api." } }, { "id": "CVE-2024-56337", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:a5ece07e-8790-58e2-813e-0398b1f98d64", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-56337 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-api." } }, { "id": "CVE-2025-24813", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:facb7a17-3311-5e3e-bef6-878777152d54", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-24813 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-api." } }, { "id": "CVE-2025-31650", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:ccb56d77-83b3-5d9a-b3b0-d1676cf899ec", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31650 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-api." } }, { "id": "CVE-2025-31651", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:5d49f7f0-235a-59a7-a9dc-83b2ac61ba32", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31651 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-api." } }, { "id": "CVE-2025-46701", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:2e191586-1464-5e61-8da1-bb9ac2f69bb0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-46701 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-api." } }, { "id": "CVE-2025-48988", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:ea76f08a-22dc-53cb-bc23-28e17ea1187c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-48988 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-api." } }, { "id": "CVE-2025-48989", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:eec658af-ad67-5041-b8e6-96506d27ec09", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48989 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-api." } }, { "id": "CVE-2025-49124", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:9b58c9ec-6ac9-542a-9a22-12870ce65fe2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49124 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-api." } }, { "id": "CVE-2025-49125", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:3f8a1d35-7e8a-5c5f-952f-3b361edb10f5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49125 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-api." } }, { "id": "CVE-2025-52520", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:f15679c5-3fe2-5a94-9d53-0e94c7d12108", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-52520 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-api." } }, { "id": "CVE-2025-53506", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:1c1349cf-88f7-582d-9f5f-c425b30323b4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-53506 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-api." } }, { "id": "CVE-2025-55668", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:cfe5acc2-0377-5112-8fef-cbc45ac34c59", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55668 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-api." } }, { "id": "CVE-2025-55752", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:82e77687-dba6-5f6b-b542-d398d69f463b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-55752 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-api. Version 10.1.16 is NOT vulnerable to CVE-2025-55752. The vulnerable code pattern (normalizing before decoding in RewriteValve) was introduced later in version 10.1.40. Version 10.1.16 uses a different code structure that does not call URLDecoder.decode after RequestUtil.normalize, thus the vulnerability is not present. The CVE advisory's version range \"10.1.0-M1 through 10.1.44\" is over-broad; only versions 10.1.40-10.1.44 contain the vulnerable pattern.", "justification": "code_not_present" } }, { "id": "CVE-2025-55754", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:5dc7f091-65b0-52ed-8fd0-c0767265433f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55754 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-api." } }, { "id": "CVE-2025-61795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:f1a2bc0f-7a6a-54cc-94b4-92505ce7d9d4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-61795 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-api." } }, { "id": "CVE-2025-66614", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:59120f04-8b4b-55c1-a2a6-fc46a8b179e9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66614 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-api." } }, { "id": "CVE-2026-24733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:e6a05e04-a10d-5556-b97e-d13673877e48", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24733 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-api." } }, { "id": "CVE-2026-24734", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:d2f7c6e9-5421-586d-85ee-5a9b8c04c845", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24734 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-api." } }, { "id": "CVE-2026-24880", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:e8790cbe-fc1b-5cd3-aa02-645a939daa15", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24880 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-api." } }, { "id": "CVE-2026-25854", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:d45b576c-2765-517e-9e17-3c12f880b36c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25854 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-api." } }, { "id": "CVE-2026-29145", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:9aa6aec0-8470-586c-8307-590c55e43705", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29145 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-api." } }, { "id": "CVE-2026-29146", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:bb68ff75-9315-570f-9daa-b849937c7ed8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29146 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-api." } }, { "id": "CVE-2026-32990", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:8da04df4-ce6b-5f56-bfe7-f990a89afa71", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-32990 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-api. not_affected \u2014 Apache Tomcat 10.1.16 is not affected by CVE-2026-32990. The vulnerability exists in the checkSni() method's incomplete fix for CVE-2025-66614, affecting versions 10.1.50-10.1.52. Version 10.1.16 predates the introduction of the strict SNI validation feature entirely - the checkSni method, strictSni field, and protocolHostName parameter do not exist in this version. The vulnerability pattern (c...", "justification": "code_not_present" } }, { "id": "CVE-2026-34483", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:4d811361-fe76-5989-8b9b-5336da526fa9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34483 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-api." } }, { "id": "CVE-2026-34487", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:9e29b99c-5910-5224-a0fb-f8312fe00c34", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34487 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-api." } }, { "id": "CVE-2026-41284", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:c6acf174-d612-556c-82bc-b86db024563b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41284 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-api." } }, { "id": "CVE-2026-41293", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:d34d6c3a-46cb-5fb5-8afc-86c93ef0e2b0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41293 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-api." } }, { "id": "CVE-2026-42498", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:44891b5e-f54c-5e70-9811-4f4caa43a3f2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42498 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-api." } }, { "id": "CVE-2026-43512", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:c4ab6f07-12f0-5386-80f4-7ace08120ae0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43512 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-api." } }, { "id": "CVE-2026-43513", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:d87e9441-6d85-57b7-9903-863408f44b39", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43513 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-api." } }, { "id": "CVE-2026-43514", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:b48eafe9-f79f-553b-877b-a70e2b7505db", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43514 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-api." } }, { "id": "CVE-2026-43515", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:08ac5c11-cbbf-5ec8-a536-8e01462dafac", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-43515 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-api." } }, { "id": "CVE-2026-53434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:5eead207-7928-54bc-9e5e-0e1479ca3482", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53434 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-api." } }, { "id": "CVE-2026-65182", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:6d343fbc-76ae-50e0-a2a5-1c0e4ad0e843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65182 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-api." } }, { "id": "CVE-2026-65905", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:f220bcb5-6e34-509b-b89e-83d828270386", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65905 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-api." } }, { "id": "CVE-2026-68525", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:40042dc6-6c6f-5b27-9302-40ba9c29d76d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68525 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-api." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-api@10.1.16-tuxcare.1" } ] }