{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:5fbc3ceb-c519-515f-a005-5a1dfcedbf18", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat-websocket", "purl": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.16-tuxcare.1", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.16-tuxcare.1", "version": "10.1.16-tuxcare.1", "pedigree": { "ancestors": [ { "name": "tomcat-websocket", "purl": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.16", "type": "library", "group": "org.apache.tomcat", "version": "10.1.16" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-23672", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:cdbaae12-7868-5166-9b4f-dd2ac8c177b1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-23672 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket." } }, { "id": "CVE-2024-24549", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:e19fe60d-5bf7-5de7-9b2d-771c6d7d0ed6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-24549 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket." } }, { "id": "CVE-2024-34750", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:6e610ff6-5bc6-5ef7-9b85-0d9e59226af1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34750 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket." } }, { "id": "CVE-2024-38286", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:a218fd31-fc7d-5d6d-a6c8-f175f18675a6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38286 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket." } }, { "id": "CVE-2024-50379", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:65b49822-6e9e-53a8-b527-cfbfedee6ce0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-50379 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket." } }, { "id": "CVE-2024-52316", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:c34dc71e-240e-5808-9d4c-fc828de47702", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-52316 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket." } }, { "id": "CVE-2024-54677", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:8d794fd5-00bb-59e1-a00d-995b819566f6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-54677 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket." } }, { "id": "CVE-2024-56337", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:a0b01e98-ef92-5edc-b422-70ae0b670f51", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-56337 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket." } }, { "id": "CVE-2025-24813", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:aa44a3e4-826b-5dcd-9b2d-a37e5597c697", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-24813 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket." } }, { "id": "CVE-2025-31650", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:f7485c00-f957-50ca-b431-c2829a75fd9b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31650 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket." } }, { "id": "CVE-2025-31651", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:17c51b2f-20b3-5e38-adea-b26137020870", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31651 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket." } }, { "id": "CVE-2025-46701", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:1580bb8a-5d1e-53a5-a1a7-501196342ff0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-46701 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket." } }, { "id": "CVE-2025-48988", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:349d2337-633f-59f7-bf96-79e50f0d3d76", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-48988 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket." } }, { "id": "CVE-2025-48989", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:d115cb4d-745d-5c7b-b429-823399ddb82f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48989 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket." } }, { "id": "CVE-2025-49124", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:ae73f60b-20c0-591a-af8c-964b7546b462", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49124 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket." } }, { "id": "CVE-2025-49125", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:d1835d80-733d-5040-8508-04e16df84a2b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49125 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket." } }, { "id": "CVE-2025-52520", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:6ec44d36-23ca-5304-9c21-71cb8607eec0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-52520 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket." } }, { "id": "CVE-2025-53506", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:364c2a53-b26c-5335-b3fb-8770d1ea6cdd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-53506 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket." } }, { "id": "CVE-2025-55668", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:005d9cb4-15ff-56ad-9667-5a2eb9999641", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55668 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket." } }, { "id": "CVE-2025-55752", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:4f193772-a6a3-57da-ac85-6b1361986e35", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-55752 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket. Version 10.1.16 is NOT vulnerable to CVE-2025-55752. The vulnerable code pattern (normalizing before decoding in RewriteValve) was introduced later in version 10.1.40. Version 10.1.16 uses a different code structure that does not call URLDecoder.decode after RequestUtil.normalize, thus the vulnerability is not present. The CVE advisory's version range \"10.1.0-M1 through 10.1.44\" is over-broad; only versions 10.1.40-10.1.44 contain the vulnerable pattern.", "justification": "code_not_present" } }, { "id": "CVE-2025-55754", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:913347f1-3226-55a0-b673-ece510a6eca2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55754 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket." } }, { "id": "CVE-2025-61795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:9c2e93bf-2842-5d76-a9fc-2f9b80ad3813", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-61795 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket." } }, { "id": "CVE-2025-66614", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:e9037415-2c4f-5ecc-bae9-248ca85ae5c9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66614 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket." } }, { "id": "CVE-2026-24733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:027f3669-93d7-5313-aedf-9b81bd4168f1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24733 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket." } }, { "id": "CVE-2026-24734", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:4c16c3bc-1104-54b2-bd38-a486aaa12d2b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24734 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket." } }, { "id": "CVE-2026-24880", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:92b3b47a-7e1f-554c-a76f-d0bfaf81804e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24880 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket." } }, { "id": "CVE-2026-25854", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:4229e371-241e-57fe-a2e3-c017b4fa613d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25854 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket." } }, { "id": "CVE-2026-29145", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:dbc551b8-cdf5-573b-b5c1-6534ad32f8ae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29145 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket." } }, { "id": "CVE-2026-29146", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:fc009360-e004-57d6-9da4-eb1b6cd341b6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29146 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket." } }, { "id": "CVE-2026-32990", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:07fbe3bd-8d7e-5b93-a670-80da8fa0b054", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-32990 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket. not_affected \u2014 Apache Tomcat 10.1.16 is not affected by CVE-2026-32990. The vulnerability exists in the checkSni() method's incomplete fix for CVE-2025-66614, affecting versions 10.1.50-10.1.52. Version 10.1.16 predates the introduction of the strict SNI validation feature entirely - the checkSni method, strictSni field, and protocolHostName parameter do not exist in this version. The vulnerability pattern (c...", "justification": "code_not_present" } }, { "id": "CVE-2026-34483", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:779210b3-d9ff-5e01-9702-3c763dd14bdc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34483 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket." } }, { "id": "CVE-2026-34487", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:2375d420-6eb8-53d3-a8c1-d8b1adbdb150", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34487 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket." } }, { "id": "CVE-2026-41284", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:70bfd026-081a-5b26-b06b-3496ec201f4c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41284 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket." } }, { "id": "CVE-2026-41293", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:703fbb8f-ec1f-5009-ac15-926749c9a983", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41293 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket." } }, { "id": "CVE-2026-42498", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:877ed663-64a9-5127-bc0a-75c0065f3b24", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42498 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket." } }, { "id": "CVE-2026-43512", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:27f58392-6bc3-54e6-a68a-77b262033055", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43512 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket." } }, { "id": "CVE-2026-43513", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:4bc1b46a-f512-5029-9ce6-d78795d46345", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43513 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket." } }, { "id": "CVE-2026-43514", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:f25a41e4-f678-5c74-a38d-6a4dd5a71a55", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43514 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket." } }, { "id": "CVE-2026-43515", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:a041f902-6252-5af1-a8f7-55d5f99b2a23", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-43515 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket." } }, { "id": "CVE-2026-53434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:14ae4bb7-0296-5c45-b603-e53dc6b43e06", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53434 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket." } }, { "id": "CVE-2026-65182", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:a25844f6-f9a7-50cb-a7de-bc117de9bf3a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65182 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket." } }, { "id": "CVE-2026-65905", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:f81034e1-fa83-5bdd-ab83-7793c66f1ae0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65905 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket." } }, { "id": "CVE-2026-68525", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:e9957084-1f92-5e6e-97f3-d9fc7cc7a88d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68525 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-websocket." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.16-tuxcare.1" } ] }