{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:90af03bd-0098-5332-aa67-f1ebf3d18286", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat-catalina-ha", "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1", "version": "10.1.16-tuxcare.1", "pedigree": { "ancestors": [ { "name": "tomcat-catalina-ha", "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16", "type": "library", "group": "org.apache.tomcat", "version": "10.1.16" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-23672", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:e03ae283-e56f-5e5f-a540-cfd57bbe8136", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-23672 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2024-24549", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:afbbf86f-1542-5a23-b186-7f4fb646c79c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-24549 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2024-34750", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:1f2286e5-f169-53ba-b15d-da8a64c1a06b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34750 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2024-38286", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:56f3836e-a171-5f9a-a75f-d775ea2b8e04", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38286 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2024-50379", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:ac184ff1-6784-5183-9736-5549971743de", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-50379 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2024-52316", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:4471bd31-bcd5-5328-974d-ed987d3526f3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-52316 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2024-54677", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:88acb26c-4302-5fd1-ba30-b880469956ba", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-54677 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2024-56337", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:c719ca42-3fe5-551e-977d-1c2c403012f4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-56337 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2025-24813", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:286b5a0e-5ad8-5413-a484-9fdfcdbfa505", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-24813 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2025-31650", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:7e14fd0b-017a-5721-a50b-99424aa0d2f2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31650 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2025-31651", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:d8d31812-b74f-5b09-ae69-81f73c56d073", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31651 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2025-46701", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:e8903853-5f49-55cd-b165-d10d962f0a63", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-46701 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2025-48988", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:33fb6b3d-eec7-5662-b42c-2d870260e4ce", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-48988 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2025-48989", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:f6798fc7-8a10-50ea-86db-54502dac78c6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48989 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2025-49124", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:6c78343a-e06c-545f-889c-4f64dc02fe81", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49124 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2025-49125", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:332cab42-9d80-5678-a694-5e9eaad9a460", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49125 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2025-52520", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:dddcb1c3-76b9-57f5-a0dd-05d8bf1ffb1b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-52520 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2025-53506", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:cb1e6e65-bc94-53ac-8223-b5e6cd8cb35c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-53506 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2025-55668", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:ef4ed758-96d5-55a0-bafa-51aab26de703", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55668 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2025-55752", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:e70c32e0-52e0-50f9-97e9-594a04f96890", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-55752 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha. Version 10.1.16 is NOT vulnerable to CVE-2025-55752. The vulnerable code pattern (normalizing before decoding in RewriteValve) was introduced later in version 10.1.40. Version 10.1.16 uses a different code structure that does not call URLDecoder.decode after RequestUtil.normalize, thus the vulnerability is not present. The CVE advisory's version range \"10.1.0-M1 through 10.1.44\" is over-broad; only versions 10.1.40-10.1.44 contain the vulnerable pattern.", "justification": "code_not_present" } }, { "id": "CVE-2025-55754", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:1bccaa85-0497-5c23-be56-dc8d6e8caa3a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55754 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2025-61795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:e99dd9a2-ccbc-596c-82d8-767e9adcf657", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-61795 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2025-66614", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:58f3c5cb-9982-5a65-bd6e-c968a6b1412a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66614 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2026-24733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:4095eeba-940f-5e0b-a553-a4f50c739fd2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24733 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2026-24734", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:b694a483-5b5b-5158-ac29-c9d12b13ff30", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24734 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2026-24880", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:76fee4d0-8791-5eb5-b65f-ce0ad831dd2e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24880 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2026-25854", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:c67809bd-0db5-5fdd-96f6-db97aea1ae02", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25854 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2026-29145", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:e467f09c-d63f-5c0e-98a0-e1734aeb2aea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29145 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2026-29146", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:5bff81ee-2949-5a85-a613-2746e9eee5eb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29146 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2026-32990", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:2ddc4ff4-b162-5d9a-a758-7455f655222e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-32990 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha. not_affected \u2014 Apache Tomcat 10.1.16 is not affected by CVE-2026-32990. The vulnerability exists in the checkSni() method's incomplete fix for CVE-2025-66614, affecting versions 10.1.50-10.1.52. Version 10.1.16 predates the introduction of the strict SNI validation feature entirely - the checkSni method, strictSni field, and protocolHostName parameter do not exist in this version. The vulnerability pattern (c...", "justification": "code_not_present" } }, { "id": "CVE-2026-34483", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:84bb01af-de8f-5394-989d-0b6fe80f45b3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34483 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2026-34487", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:e6eeb908-867a-536f-9ef6-ee6dbc0b3dfd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34487 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2026-41284", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:cdbc66f1-c8c9-51cd-ba88-d2ed30f1bf3e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41284 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2026-41293", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:cbf9d1eb-d919-5cae-9dbe-fb76e12c6d5d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41293 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2026-42498", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:075f7ad8-b06f-58d1-880b-bf28ca5ad930", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42498 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2026-43512", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:b828e4f0-bda4-5f89-9faf-d83b1bf9e65a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43512 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2026-43513", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:18c8d425-dcd0-5f06-8f85-48bb88fa5336", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43513 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2026-43514", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:57ad9848-b76e-5ac3-a345-5df6b427bad9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43514 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2026-43515", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:49f03fbe-1c2f-5c03-82fe-1bb7a3dc5ce6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-43515 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2026-53434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:6e4f907b-bf10-59df-8a0a-94427f17cd3c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53434 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2026-65182", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:25ffe144-c9c6-5cd6-b813-aff8ac3baaf4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65182 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2026-65905", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:16814730-5dd5-5b85-ba8f-a20603191424", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65905 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2026-68525", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:3a2cbbe7-0875-5426-9e32-cbe25d55de44", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68525 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@10.1.16-tuxcare.1" } ] }