{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:1523bc29-d2ef-56a6-ab24-01cef1cbd00c", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat-websocket-client-api", "purl": "pkg:maven/org.apache.tomcat/tomcat-websocket-client-api@10.1.16-tuxcare.1", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-client-api@10.1.16-tuxcare.1", "version": "10.1.16-tuxcare.1", "pedigree": { "ancestors": [ { "name": "tomcat-websocket-client-api", "purl": "pkg:maven/org.apache.tomcat/tomcat-websocket-client-api@10.1.16", "type": "library", "group": "org.apache.tomcat", "version": "10.1.16" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-23672", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-client-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:e1a789e7-c1ed-5182-8aa2-a7a8967cfeb8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-23672 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-client-api." } }, { "id": "CVE-2024-24549", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-client-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:3b8497b7-bc6e-5026-9d5a-26f200b77668", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-24549 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-client-api." } }, { "id": "CVE-2024-34750", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-client-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:a61e7368-4a6a-59d0-a0ab-efe031101b31", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34750 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-client-api." } }, { "id": "CVE-2024-38286", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-client-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:5298f2db-0409-51d8-8c90-01d16f6e1831", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38286 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-client-api." } }, { "id": "CVE-2024-50379", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-client-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:34511549-8103-50b7-ae69-45e60de43e32", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-50379 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-client-api." } }, { "id": "CVE-2024-52316", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-client-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:d8e75801-5abe-5f27-9c72-db65696dba46", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-52316 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-client-api." } }, { "id": "CVE-2024-54677", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-client-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:f6169e43-a7b6-565f-9959-45fe8318fdc9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-54677 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-client-api." } }, { "id": "CVE-2024-56337", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-client-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:0dc34459-990b-5c78-b7a2-143c204e97b5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-56337 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-client-api." } }, { "id": "CVE-2025-24813", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-client-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:4b7bf391-839c-51b4-a3ad-3a10f142fda9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-24813 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-client-api." } }, { "id": "CVE-2025-31650", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-client-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:51c4bd1f-3f38-5521-956d-bbeed442951c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31650 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-client-api." } }, { "id": "CVE-2025-31651", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-client-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:94ec638b-fbbc-530c-930e-de9782dfd32d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31651 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-client-api." } }, { "id": "CVE-2025-46701", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-client-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:73ef184d-aff6-57fa-aaeb-213e7c072a58", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-46701 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-client-api." } }, { "id": "CVE-2025-48988", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-client-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:21a159d3-0b1c-57e3-bce0-d3511226006b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-48988 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-client-api." } }, { "id": "CVE-2025-48989", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-client-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:779d808b-efca-5105-babb-666764dabff2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48989 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-client-api." } }, { "id": "CVE-2025-49124", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-client-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:8ad57d8c-067a-5fdb-93d1-55d1fad9ae92", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49124 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-client-api." } }, { "id": "CVE-2025-49125", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-client-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:04220c7f-1002-58e3-8b4f-440d1c4a9989", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49125 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-client-api." } }, { "id": "CVE-2025-52520", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-client-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:e02393df-fa14-5f85-8c78-1e346fb922ec", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-52520 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-client-api." } }, { "id": "CVE-2025-53506", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-client-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:47c2b690-4a06-536c-9a22-4c2d8086c220", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-53506 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-client-api." } }, { "id": "CVE-2025-55668", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-client-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:26feff0a-a038-51b1-a374-e57e4fefc878", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55668 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-client-api." } }, { "id": "CVE-2025-55752", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-client-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:c54f5f61-1754-5fb6-8fef-5d65f937338f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-55752 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-client-api. Version 10.1.16 is NOT vulnerable to CVE-2025-55752. The vulnerable code pattern (normalizing before decoding in RewriteValve) was introduced later in version 10.1.40. Version 10.1.16 uses a different code structure that does not call URLDecoder.decode after RequestUtil.normalize, thus the vulnerability is not present. The CVE advisory's version range \"10.1.0-M1 through 10.1.44\" is over-broad; only versions 10.1.40-10.1.44 contain the vulnerable pattern.", "justification": "code_not_present" } }, { "id": "CVE-2025-55754", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-client-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:04d32e07-212e-56d1-a553-ba20c9d9b794", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55754 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-client-api." } }, { "id": "CVE-2025-61795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-client-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:b44107f8-a7a5-53fb-96c0-ce0103ef97b7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-61795 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-client-api." } }, { "id": "CVE-2025-66614", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-client-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:17c8cd07-dc16-555d-b4f7-df372dce11e0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66614 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-client-api." } }, { "id": "CVE-2026-24733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-client-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:1fcaab42-7683-5305-b3b5-8d4ff58deb87", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24733 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-client-api." } }, { "id": "CVE-2026-24734", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-client-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:21a9be18-8790-5c57-ac44-a6dd9a031eeb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24734 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-client-api." } }, { "id": "CVE-2026-24880", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-client-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:ad1f6c08-13cd-5e6d-9413-443e555c9d86", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24880 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-client-api." } }, { "id": "CVE-2026-25854", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-client-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:e77b1d8f-5baa-5ec1-bed4-b54bd1701c91", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25854 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-client-api." } }, { "id": "CVE-2026-29145", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-client-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:43e190f0-e833-51ee-9582-0105842eaaaf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29145 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-client-api." } }, { "id": "CVE-2026-29146", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-client-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:66a39502-0619-5591-b9c1-1810eed18ace", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29146 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-client-api." } }, { "id": "CVE-2026-32990", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-client-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:0b881909-090d-553c-b418-9289bdb42612", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-32990 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-client-api. not_affected \u2014 Apache Tomcat 10.1.16 is not affected by CVE-2026-32990. The vulnerability exists in the checkSni() method's incomplete fix for CVE-2025-66614, affecting versions 10.1.50-10.1.52. Version 10.1.16 predates the introduction of the strict SNI validation feature entirely - the checkSni method, strictSni field, and protocolHostName parameter do not exist in this version. The vulnerability pattern (c...", "justification": "code_not_present" } }, { "id": "CVE-2026-34483", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-client-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:9ded4a38-b42b-5efd-a745-c16016bb1bfd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34483 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-client-api." } }, { "id": "CVE-2026-34487", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-client-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:186ed01c-d30c-515c-b9b8-6cc1cb335497", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34487 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-client-api." } }, { "id": "CVE-2026-41284", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-client-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:d35ca135-1860-5348-a3fc-dcc859549547", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41284 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-client-api." } }, { "id": "CVE-2026-41293", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-client-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:0dd5fa07-ff4b-5b13-83a8-a28f5d4fe670", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41293 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-client-api." } }, { "id": "CVE-2026-42498", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-client-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:9d23502c-fb7f-50f6-b749-edfe8f87e24a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42498 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-client-api." } }, { "id": "CVE-2026-43512", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-client-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:88c9dc4b-7d45-5009-8ca6-c9bcab890d3e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43512 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-client-api." } }, { "id": "CVE-2026-43513", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-client-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:a653c2b3-e6bc-5653-92c1-247cb225cf63", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43513 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-client-api." } }, { "id": "CVE-2026-43514", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-client-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:c57526b9-f9e9-5d0d-833f-17ddc8b6cec9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43514 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-client-api." } }, { "id": "CVE-2026-43515", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-client-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:03ff1d6e-4bde-57bc-8263-1532be1cf0e2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-43515 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-client-api." } }, { "id": "CVE-2026-53434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-client-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:2bb8c101-3e63-5814-81ff-143194351414", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53434 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-client-api." } }, { "id": "CVE-2026-65182", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-client-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:1b4c6ea8-8e0b-5ebf-8438-f8c0b9c391df", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65182 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-client-api." } }, { "id": "CVE-2026-65905", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-client-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:fe481532-0b7b-5ac8-8cd7-20ee5a6dc29e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65905 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-client-api." } }, { "id": "CVE-2026-68525", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-client-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:2e7e32ce-2f56-5d01-8976-75ef2298ead3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68525 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket-client-api." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket-client-api@10.1.16-tuxcare.1" } ] }