{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:6ae89f57-89c0-59a9-9bb4-a07df09f0574", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat-api", "purl": "pkg:maven/org.apache.tomcat/tomcat-api@10.1.16-tuxcare.1", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-api@10.1.16-tuxcare.1", "version": "10.1.16-tuxcare.1", "pedigree": { "ancestors": [ { "name": "tomcat-api", "purl": "pkg:maven/org.apache.tomcat/tomcat-api@10.1.16", "type": "library", "group": "org.apache.tomcat", "version": "10.1.16" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-23672", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:97a3dba5-ae40-5362-a0ef-0ab9495393f4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-23672 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-api." } }, { "id": "CVE-2024-24549", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:ba3f3f21-6163-521b-b384-8ace2f797f95", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-24549 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-api." } }, { "id": "CVE-2024-34750", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:42095b0f-de66-5e48-857f-e09b91251c4b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34750 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-api." } }, { "id": "CVE-2024-38286", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:8508f587-9d7c-5532-819f-db754e2f09ca", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38286 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-api." } }, { "id": "CVE-2024-50379", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:11fa2be8-c433-5459-b862-bfdf6df4b32d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-50379 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-api." } }, { "id": "CVE-2024-52316", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:49dbacc4-a1ae-5dc7-befd-b550d0ffea42", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-52316 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-api." } }, { "id": "CVE-2024-54677", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:4c085582-1a6d-5ba8-9485-524cd251068d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-54677 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-api." } }, { "id": "CVE-2024-56337", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:8f9659d3-bef1-5093-993e-37b8bf3ce510", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-56337 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-api." } }, { "id": "CVE-2025-24813", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:581160bb-40f1-5773-b402-eded714bf11a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-24813 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-api." } }, { "id": "CVE-2025-31650", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:35df76f1-50e5-51a2-9689-ee9d05d3cb9b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31650 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-api." } }, { "id": "CVE-2025-31651", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:dee64ab4-045d-55d5-8373-80b84791adf4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31651 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-api." } }, { "id": "CVE-2025-46701", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:64a2ca79-bd5e-521a-b6a9-f7f08fe15977", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-46701 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-api." } }, { "id": "CVE-2025-48988", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:44665f09-a13a-5cc5-af61-bbb4379fd00e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-48988 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-api." } }, { "id": "CVE-2025-48989", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:dbd1ef65-3714-53c3-9b54-4b30b8e5afde", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48989 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-api." } }, { "id": "CVE-2025-49124", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:370d9117-2a6b-5a94-9723-263eb1965478", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49124 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-api." } }, { "id": "CVE-2025-49125", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:24eb258a-381f-5e49-84b7-a0c2d42b08e5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49125 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-api." } }, { "id": "CVE-2025-52520", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:3ba42aca-13e5-5195-8488-a6cf2937ad34", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-52520 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-api." } }, { "id": "CVE-2025-53506", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:48a99a5d-d749-5b74-8307-e1bc6693179c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-53506 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-api." } }, { "id": "CVE-2025-55668", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:a177b1f4-424d-5bf2-8f8c-7c16e93f7327", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55668 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-api." } }, { "id": "CVE-2025-55752", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:2e8baed8-6176-57b6-89cf-2e19ef4283a0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-55752 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-api. Version 10.1.16 is NOT vulnerable to CVE-2025-55752. The vulnerable code pattern (normalizing before decoding in RewriteValve) was introduced later in version 10.1.40. Version 10.1.16 uses a different code structure that does not call URLDecoder.decode after RequestUtil.normalize, thus the vulnerability is not present. The CVE advisory's version range \"10.1.0-M1 through 10.1.44\" is over-broad; only versions 10.1.40-10.1.44 contain the vulnerable pattern.", "justification": "code_not_present" } }, { "id": "CVE-2025-55754", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:112dd8d9-89b0-5637-bc57-8d57f3ea2a54", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55754 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-api." } }, { "id": "CVE-2025-61795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:1be91c11-f8c3-582b-93e0-45598ac2fe78", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-61795 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-api." } }, { "id": "CVE-2025-66614", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:7dda50ef-2336-55dd-b13a-393bb732dee5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66614 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-api." } }, { "id": "CVE-2026-24733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:32b36599-6948-540f-99fa-0a1c6bfeb5be", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24733 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-api." } }, { "id": "CVE-2026-24734", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:ac5ade0e-b81c-5654-b259-9ab3208f7c52", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24734 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-api." } }, { "id": "CVE-2026-24880", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:674e6d4f-99a6-53d1-919a-054e00dce159", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24880 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-api." } }, { "id": "CVE-2026-25854", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:d39ffb2f-2ce0-578f-a856-2f6741a283e3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25854 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-api." } }, { "id": "CVE-2026-29145", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:7bfc8486-7410-5a5a-bcd9-becd355b951f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29145 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-api." } }, { "id": "CVE-2026-29146", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:0e040f61-f707-5d39-84d8-24c03ef44b4c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29146 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-api." } }, { "id": "CVE-2026-32990", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:cd3d95fc-f621-5d60-be7a-248e5793a8dc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-32990 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-api. not_affected \u2014 Apache Tomcat 10.1.16 is not affected by CVE-2026-32990. The vulnerability exists in the checkSni() method's incomplete fix for CVE-2025-66614, affecting versions 10.1.50-10.1.52. Version 10.1.16 predates the introduction of the strict SNI validation feature entirely - the checkSni method, strictSni field, and protocolHostName parameter do not exist in this version. The vulnerability pattern (c...", "justification": "code_not_present" } }, { "id": "CVE-2026-34483", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:95863090-8bda-5111-91d5-00ceeb7f1941", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34483 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-api." } }, { "id": "CVE-2026-34487", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:3c16ba15-6700-54d5-93aa-d6b6c0278042", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34487 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-api." } }, { "id": "CVE-2026-41284", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:5b4ae60f-53d7-5443-a585-728bf12d8b59", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41284 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-api." } }, { "id": "CVE-2026-41293", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:16e4aa78-a1f8-5e72-8fc1-6b7be02d448b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41293 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-api." } }, { "id": "CVE-2026-42498", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:66c9b627-b234-5f98-9417-dc0b44cfe8aa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42498 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-api." } }, { "id": "CVE-2026-43512", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:b405d94d-276f-537b-982d-09fb3996bb61", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43512 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-api." } }, { "id": "CVE-2026-43513", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:21e27466-b318-5501-8dfa-ad8c46449efe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43513 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-api." } }, { "id": "CVE-2026-43514", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:de522a9a-2e3e-5fdb-9b24-13af217d7501", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43514 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-api." } }, { "id": "CVE-2026-43515", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:094e4979-7534-54d5-afc5-081f8b16ab78", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-43515 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-api." } }, { "id": "CVE-2026-53434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:b7b14e52-cb2e-5633-aaf1-2db71caa33c3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53434 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-api." } }, { "id": "CVE-2026-65182", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:0f04085a-4245-5680-ba3b-f50c7585ffaf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65182 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-api." } }, { "id": "CVE-2026-65905", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:baa9f3f5-13c2-5dca-8ff6-0a6117e0cb2c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65905 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-api." } }, { "id": "CVE-2026-68525", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-api@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:23b0b1c9-bb7c-516e-a6a0-77d763e61dc0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68525 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-api." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-api@10.1.16-tuxcare.1" } ] }