{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:db9f32c0-f49c-5703-af3f-210bea5c9c1b", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat-el-api", "purl": "pkg:maven/org.apache.tomcat/tomcat-el-api@8.5.78-tuxcare.2", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@8.5.78-tuxcare.2", "version": "8.5.78-tuxcare.2", "pedigree": { "ancestors": [ { "name": "tomcat-el-api", "purl": "pkg:maven/org.apache.tomcat/tomcat-el-api@8.5.78", "type": "library", "group": "org.apache.tomcat", "version": "8.5.78" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-0762", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:51699f6f-75d9-5307-aae4-40f4a80f6a9d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-0762 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-el-api. not_affected \u2014 CVE-2016-0762 timing attack vulnerability is NOT present in Tomcat 8.5.78. The upstream Apache fix (commit d79c63d424) was included in version 8.5.5 (released 2016-08-31), well before version 8.5.78 was released. All four critical Realm implementations (RealmBase, DataSourceRealm, JDBCRealm, MemoryRealm) contain the timing attack mitigation code that calls getCredentialHandler().mutate(credenti...", "justification": "code_not_present" } }, { "id": "CVE-2016-0763", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:bc8f8972-34ed-568f-b667-731f97f6c2b4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-0763 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-el-api. not_affected \u2014 CVE-2016-0763 is NOT present in Tomcat 8.5.78. The vulnerability affects the setGlobalContext method in ResourceLinkFactory.java, which in vulnerable versions lacks authorization checks, allowing untrusted web applications to replace the global JNDI context and access arbitrary application data or cause DoS. The fix (commit bc8717f41a by upstream Apache developer kkolinko@apache.org) adds a Sec...", "justification": "code_not_present" } }, { "id": "CVE-2016-5018", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:f0ee1ef1-be31-580a-ae33-bf504df6d54b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-5018 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-el-api. Apache Tomcat 8.5.78 is not affected by CVE-2016-5018. The vulnerability involved a SecurityManager bypass via the JspRuntimeLibrary.introspecthelper() method, which executed bean introspection with elevated privileges using AccessController.doPrivileged(). The fix was applied by Apache upstream in commit 648122fef8 (Aug 2, 2016) and was already present in version 8.5.78 when TuxCare onboarded it (commit fb98844404, Sep 20, 2026). The vulnerable code pattern (PrivilegedIntrospectHelper class and doPrivileged wrapper) is not present in the target.", "justification": "code_not_present" } }, { "id": "CVE-2016-6794", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:4a54d64f-7522-51fb-b1c5-213d9796c15e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-6794 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-el-api. not_affected \u2014 Apache Tomcat 8.5.78 is not affected by CVE-2016-6794. The vulnerability allows malicious web applications to bypass SecurityManager and read system properties via the configuration file property replacement feature. The fix (PermissionCheck mechanism) was already present in the upstream Apache Tomcat 8.5.78 release that TuxCare onboarded, applied by upstream author Mark Thomas in commit f8db07...", "justification": "code_not_present" } }, { "id": "CVE-2016-6796", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:8db1acbd-5885-5d25-b612-9d8e85c5424e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-6796 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-el-api. The target Tomcat 8.5.78 is NOT vulnerable to CVE-2016-6796. The vulnerability allowed malicious web applications to bypass SecurityManager restrictions by manipulating JSP servlet init-parameters `engineOptionsClass` and `scratchdir`. The fix, which adds SecurityManager checks to nullify these dangerous parameters when SecurityManager is enabled, is already present in the target code. This fix was authored by upstream maintainer Mark Thomas (markt@apache.org) in commit f97769f50e on August 30, 2016, and was included in the upstream 8.5.78 release that TuxCare onboarded. The vulnerable code pattern does not exist in this version.", "justification": "code_not_present" } }, { "id": "CVE-2016-6797", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:53deea54-54e2-56d2-a9b1-7417d4855fd0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-6797 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-el-api. CVE-2016-6797 is NOT present in Apache Tomcat 8.5.78. The vulnerability allowed web applications to access any global JNDI resource without explicit ResourceLink configuration. The upstream fix (commit d6b5600afe by Mark Thomas, August 22, 2016) added an access control mechanism that validates ClassLoader authorization before allowing global resource access. This fix was already present in the upstream Tomcat 8.5.78 release that TuxCare onboarded, making the target not affected by this vulnerability.", "justification": "code_not_present" } }, { "id": "CVE-2016-6816", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:dd588e97-2318-550f-9231-09d85bd54ac5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-6816 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-el-api. CVE-2016-6816 is NOT present in Apache Tomcat 8.5.78. The vulnerability affected versions 8.5.0-8.5.6, allowing invalid characters in HTTP request lines to enable response splitting attacks. The upstream fix by Mark Thomas (commit f96f5751d41, Nov 2016) added character validation via HttpParser.isNotRequestTarget() and HttpParser.isHttpProtocol() methods. These validations are present and active in the target at Http11InputBuffer.java lines 510 and 583, rejecting invalid characters before they reach response generation. The fix was already included in the upstream Apache Tomcat 8.5.78 release that TuxCare onboarded (commit fb98844404), making this an upstream-authored fix rather than a TuxCare backport.", "justification": "code_not_present" } }, { "id": "CVE-2016-6817", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:0392a96c-ba62-5772-aa27-6b43decdea79", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-6817 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-el-api. CVE-2016-6817 (HTTP/2 header parser infinite loop) is NOT present in Apache Tomcat 8.5.78. The target version includes the upstream fix from commit 85c63227ed, authored by Mark Thomas (markt@apache.org), which shipped in Tomcat 8.5.7. The fix dynamically expands the header read buffer when capacity is exhausted, preventing the infinite loop that occurred when headers exceeded the fixed 1024-byte buffer. The vulnerable pattern (fixed-size buffer causing infinite loop when remaining() == 0 and payloadSize > 0) does not exist in the target code.", "justification": "code_not_present" } }, { "id": "CVE-2016-8745", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:4f50e9f2-a54a-5b4b-add0-ab7a6cd0ec02", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-8745 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-el-api. CVE-2016-8745 affects Tomcat 8.5.0 to 8.5.8. The target version 8.5.78 already contains the upstream fix from commit 16a57bc885 (Nov 2016) which prevents the Processor object from being added to the cache multiple times during sendfile error handling. The vulnerable code pattern (unconditional cancelledKey calls in error paths) is not present. The fix was authored by upstream Apache and shipped in the 8.5.78 release that TuxCare onboarded.", "justification": "code_not_present" } }, { "id": "CVE-2016-8747", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:a58e6bbe-6cf7-5928-a5b3-fc312270bf02", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-8747 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-el-api. Apache Tomcat 8.5.78 is NOT vulnerable to CVE-2016-8747. The vulnerability affected versions 8.5.7-8.5.9 (and 9.0.0.M11-M15) due to incorrect ByteBuffer state management in Http11InputBuffer.nextRequest() that could allow cross-request information disclosure on persistent HTTP connections. The fix (commit 9601a937ff by Mark Thomas, December 2016) was applied upstream in Tomcat 8.5.10 and is present in the target's 8.5.78 release. The vulnerable pattern is not present; the code correctly calls byteBuffer.flip() after compact() and properly resets buffer state between requests.", "justification": "code_not_present" } }, { "id": "CVE-2017-12617", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:d6a2a228-4d4f-5731-885c-fd8291a6b09f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-12617 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-el-api. The target (Apache Tomcat 8.5.78) is not affected by CVE-2017-12617. The vulnerability allowed uploading JSP files via HTTP PUT with specially crafted paths ending in '/' to bypass security checks (the Java File API drops trailing slashes). The upstream Apache Tomcat project fixed this in commits 506d862e7e and 4cf7dab882 (authored by Mark Thomas, September 2017) by adding checks that reject file write operations when the path ends with '/'. These fixes were already present in Apache Tomcat release 8.5.78 before TuxCare onboarded it (first TuxCare commit: fb98844404 \"Onboard version 8.5.78\" by amoniatovskiy@cloudlinux.com). The defensive code is verified present at AbstractFileResourceSet.java:69 and DirResourceSet.java:252.", "justification": "code_not_present" } }, { "id": "CVE-2017-5647", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:33b01707-ae38-5186-81ed-d6870994847e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-5647 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-el-api. CVE-2017-5647 is NOT present in Tomcat 8.5.78. The vulnerability (pipelined requests being lost during sendfile processing, causing response-to-request mismatches) was fixed in upstream Tomcat 8.5.13 (March 2017) by commit f5e06b8c74. The fix introduced the SendfileKeepAliveState enum with three states (NONE, PIPELINED, OPEN) to properly handle pipelined requests when sendfile completes. Version 8.5.78 shipped with this fix already in place. The fix was authored by Apache upstream (markt@apache.org), not TuxCare. All key fix components are verified present: the new enum, the input buffer check in Http11Processor.processSendfile(), and the three-state switch logic in all endpoint implementations (AprEndpoint, Nio2Endpoint, NioEndpoint).", "justification": "code_not_present" } }, { "id": "CVE-2017-5648", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:87644f59-5425-5d80-9ac2-dc963c8ca503", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-5648 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-el-api. Target Tomcat 8.5.78 is not affected by CVE-2017-5648. The vulnerability pattern (passing internal Request objects to application listeners without facade wrapping) is not present. All 7 call sites to fireRequestInitEvent() and fireRequestDestroyEvent() correctly use request.getRequest() to pass facade-wrapped objects. The fix was introduced by upstream commit 0f7b9465d5 (author: Mark Thomas, markt@apache.org) in March 2017 for Tomcat 8.5.12+, which was already present in the upstream 8.5.78 release when TuxCare onboarded it. CVE affects 8.5.0-8.5.11; target 8.5.78 is above this range.", "justification": "code_not_present" } }, { "id": "CVE-2017-5650", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:44f1f6e5-422e-5576-b359-0c10feb223f5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-5650 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-el-api. Apache Tomcat 8.5.78 is not affected by CVE-2017-5650. The vulnerability (HTTP/2 GOAWAY frames not closing streams waiting for WINDOW_UPDATE, causing thread exhaustion) was fixed in upstream commit 51eba9b70c by Mark Thomas (markt@apache.org). This fix was already present in the upstream release 8.5.78 that TuxCare onboarded, as confirmed by the fix commit being an ancestor of the first TuxCare commit fb98844404.", "justification": "code_not_present" } }, { "id": "CVE-2017-5651", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:8c12f5db-b58c-54cb-9528-f68f996fc1a4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-5651 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-el-api. The target Apache Tomcat 8.5.78 is NOT affected by CVE-2017-5651. The vulnerability (sendfile processor cache corruption leading to response mix-up) was fixed by upstream Apache developer Mark Thomas in commit 494429ca21 (bug 60918) dated March 24, 2017. This fix was already present in the upstream Apache Tomcat 8.5.78 release that TuxCare onboarded, as confirmed by git ancestry analysis showing the fix commit predates the TuxCare onboarding commit fb98844404 by 3599 commits. Code inspection confirms all fix elements are correctly implemented: SendfileState tracking variable, modified loop condition, processSendfile() method returning state, and removal of premature sendfileData clearing from prepareRequest().", "justification": "code_not_present" } }, { "id": "CVE-2017-5664", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:5cf2fb47-ec1f-5e50-93d0-09f919429b56", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-5664 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-el-api. Target Apache Tomcat 8.5.78 is NOT AFFECTED by CVE-2017-5664. The vulnerability affects Tomcat versions 8.5.0 to 8.5.14, but version 8.5.78 already contains the upstream fix. Commit 29893e66111d33cfe99dd01cb146317c0c262ef4 (authored by Mark Thomas on May 2, 2017) added DispatcherType.ERROR checks in both DefaultServlet and WebdavServlet service() methods, forcing all error dispatches to be processed via doGet() regardless of the original HTTP method. This fix was shipped in the upstream Apache Tomcat 8.5.78 release and was present when TuxCare onboarded the version (commit fb98844404). The vulnerable pattern (allowing write methods like PUT/DELETE to execute on static error pages during error dispatch) no longer exists in the codebase.", "justification": "code_not_present" } }, { "id": "CVE-2017-7674", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:b7f5e344-985e-5e26-8643-d7c8ab596038", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-7674 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-el-api. not_affected \u2014 The target (Apache Tomcat 8.5.78) is not affected by CVE-2017-7674. The vulnerability (missing Vary header in CORS Filter responses leading to cache poisoning) was fixed in upstream Apache Tomcat 8.5.16 (May 2017) via commit 9044c1672b, and further refined in commit d8db00eb64 (July 2018). Both fixes were already present in the upstream 8.5.78 release that TuxCare onboarded (commit fb98844404)....", "justification": "code_not_present" } }, { "id": "CVE-2017-7675", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:af23ad09-2170-5db7-aeae-532bc64c37b2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-7675 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-el-api. Apache Tomcat 8.5.78 is NOT affected by CVE-2017-7675. The vulnerability (bypassing security constraints via path parameter stripping in HTTP/2 requests) was fixed in upstream Apache Tomcat by commit dacb030b85 on May 24, 2017. This fix was already present in the upstream Apache Tomcat 8.5.78 release that TuxCare onboarded in September 2026. The fix changes HTTP/2 `:path` header processing in Stream.java to set the URI as bytes (preserving path parameters) instead of as String (which stripped them), ensuring downstream security checks receive the complete path.", "justification": "code_not_present" } }, { "id": "CVE-2018-1304", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:b99eeff1-62f4-5711-8ce9-e546107b910f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1304 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-el-api. not_affected \u2014 The target Apache Tomcat 8.5.78 is not affected by CVE-2018-1304. The vulnerability was fixed in upstream Apache Tomcat 8.5.28 (February 2018) by commit 5af7c13cff, authored by Mark Thomas (markt@apache.org). This fix was already present when TuxCare onboarded version 8.5.78, as confirmed by the fix commit being an ancestor of the first TuxCare commit (fb98844404 \"Onboard version 8.5.78\"). The ...", "justification": "code_not_present" } }, { "id": "CVE-2018-1305", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:5a092188-4977-5ead-bac4-f027e3764b9c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1305 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-el-api. not_affected \u2014 CVE-2018-1305 is NOT present in Apache Tomcat 8.5.78. The vulnerability affected versions 8.5.0 to 8.5.27. The target version 8.5.78 includes the upstream fix (commit 2349801827, Feb 2018) which moved ServletSecurity annotation processing from servlet load time to application startup, eliminating the race condition where security constraints could be bypassed based on servlet load order. The fi...", "justification": "code_not_present" } }, { "id": "CVE-2018-1336", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:3733c725-5abc-5638-aa51-f9b42ae1bad6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1336 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-el-api. CVE-2018-1336 is NOT present in Tomcat 8.5.78. The vulnerability (improper overflow handling in UTF-8 decoder causing infinite loops with supplementary characters) was fixed by upstream Apache Tomcat commit e00812b94e on 2018-04-27. This fix was already included in the upstream 8.5.78 release that TuxCare onboarded. The defense code is present at Utf8Decoder.java:280-286, which rewinds input position by 3 bytes before signaling OVERFLOW when decoding 4-byte UTF-8 sequences, preventing the infinite loop that would occur without proper position management.", "justification": "code_not_present" } }, { "id": "CVE-2018-8014", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:b3f8d59e-9d1b-532e-a48a-50a3cbb7ffd0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-8014 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-el-api. CVE-2018-8014 is not present in Apache Tomcat 8.5.78. The vulnerability affected Tomcat 8.5.0 to 8.5.31 with insecure CORS filter defaults (supportsCredentials=true for all origins). The upstream fix was applied in version 8.5.32 (May 2018) by commit 60f596a21f, authored by Mark Thomas (markt@apache.org). Version 8.5.78 includes this fix: DEFAULT_ALLOWED_ORIGINS=\"\" (not \"*\"), DEFAULT_SUPPORTS_CREDENTIALS=\"false\" (not \"true\"), validation preventing supportsCredentials=true with allowedOrigins=*, and simplified logic in addStandardHeaders. The vulnerable pattern is absent because the fix shipped in the upstream release before TuxCare onboarded this version.", "justification": "code_not_present" } }, { "id": "CVE-2018-8034", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:9b924dcb-9fac-5ad2-9d0a-62aa8ed47d9e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-8034 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-el-api. CVE-2018-8034 (missing hostname verification in WebSocket TLS connections) is NOT present in Apache Tomcat 8.5.78. The vulnerability was fixed by upstream developer Mark Thomas in commit f6bf951acb (June 2018), which added mandatory hostname verification via setEndpointIdentificationAlgorithm(\"HTTPS\"). This fix was already present in the upstream Apache Tomcat 8.5.78 release (2022) before TuxCare onboarded it in September 2026. The target code at WsWebSocketContainer.java:950-956 unconditionally applies hostname verification to all WebSocket TLS connections with no bypass paths.", "justification": "code_not_present" } }, { "id": "CVE-2020-11996", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:6572b661-7e4d-506a-ae6a-6dad4101c4ac", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-11996 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-el-api. CVE-2020-11996 affects Apache Tomcat 8.5.0 to 8.5.55. The target repository is version 8.5.78, which contains the upstream fix committed by Mark Thomas (markt@apache.org) in May-September 2020. The vulnerable code pattern - a loop iterating through numeric stream ID ranges - has been replaced with iteration over actual existing streams using ConcurrentNavigableMap.subMap(). This prevents CPU exhaustion when processing HTTP/2 requests with large stream ID gaps. The fix was present in upstream tag 8.5.56 and was already included when TuxCare onboarded version 8.5.78.", "justification": "code_not_present" } }, { "id": "CVE-2020-13934", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:cc5b3489-b492-5275-99d6-d4a9cf7f12ed", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-13934 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-el-api. Target version 8.5.78 is not affected by CVE-2020-13934. The vulnerability (failure to release HTTP/1.1 processor after h2c upgrade leading to memory exhaustion) was fixed in upstream Apache Tomcat by commit 923d834500 authored by Mark Thomas (markt@apache.org). This fix was included in the upstream 8.5.78 release, which is newer than the last affected version (8.5.56). The target repository contains the complete fix: the HTTP/1.1 processor is properly released via `release(processor)` before creating the HTTP/2 upgrade processor, and the control flow correctly uses `state = SocketState.CLOSED` to trigger cleanup.", "justification": "code_not_present" } }, { "id": "CVE-2020-13943", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:acb047f3-0716-5dae-9783-7c9e21d7e072", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-13943 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-el-api. not_affected \u2014 Apache Tomcat 8.5.78 is not affected by CVE-2020-13943. The upstream fix was already present in version 8.5.78 when TuxCare onboarded it. The CVE affects versions 8.5.0 to 8.5.57; this is 8.5.78. The vulnerability involved HTTP/2 header confusion when concurrent stream limits were exceeded due to checking limits during initial header parsing (headersStart) rather than after complete parsing (he...", "justification": "code_not_present" } }, { "id": "CVE-2020-9484", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:b2863191-eccf-53fc-8ae0-3d8869091859", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-9484 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-el-api. CVE-2020-9484 deserialization vulnerability is NOT present in Apache Tomcat 8.5.78. The fix was authored by Mark Thomas (Apache upstream) on May 5, 2020, and shipped in Apache Tomcat 8.5.55. Version 8.5.78 inherits this fix from upstream. The FileStore.java file at lines 355-358 implements path traversal validation that rejects session IDs attempting to escape the storage directory, preventing deserialization of attacker-controlled files. CVE affected versions: 8.5.0 to 8.5.54; target version 8.5.78 is after the fixed version.", "justification": "code_not_present" } }, { "id": "CVE-2021-24122", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:d5cdeae4-974f-588d-9a55-a73c677fe763", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-24122 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-el-api. not_affected \u2014 CVE-2021-24122 affects Apache Tomcat 8.5.0 to 8.5.59. The target is version 8.5.78, which already contains the upstream fix (commit 920dddbdb9 from 2020-11-06) that rejects colon ':' characters in Windows filenames. The fix was shipped in the upstream release before TuxCare onboarded version 8.5.78 on 2022-03-31. The vulnerable code pattern (missing ':' in isInvalidWindowsFilename check) is not...", "justification": "code_not_present" } }, { "id": "CVE-2021-42340", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:0a17e6fb-5595-5bef-a4eb-f1c69301408d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-42340 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-el-api. Target version 8.5.78 is NOT vulnerable to CVE-2021-42340. The fix for the WebSocket memory leak was already included in the upstream Apache Tomcat 8.5.78 release (March 2022) before TuxCare onboarded this version. The vulnerable pattern (failure to close WebConnection objects in WsHttpUpgradeHandler) is not present in the target code.", "justification": "code_not_present" } }, { "id": "CVE-2022-29885", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:9da17bd5-ead3-55fb-bbf9-73155b25ace4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-29885 is fixed in version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2022-34305", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:54061db3-7e9a-5fc1-afcc-6a2d0d45c7cc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-34305 is fixed in version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2022-42252", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:1ad1936e-3d80-58f1-96d5-e5da10f50d23", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-42252 is fixed in version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2022-45143", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:9a245dc2-f653-51de-8522-9e9497e5534c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-45143 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-el-api. CVE-2022-45143 affects JsonErrorReportValve, which does not exist in Tomcat 8.5.78. The vulnerability involves missing JSON escaping in type/message/description fields. The target version only has ErrorReportValve, which generates HTML error reports with proper HTML escaping (Escape.htmlElementContent). JsonErrorReportValve was introduced upstream on 2020-10-14 in versions 8.5.83+, 9.0.40+, and 10.1.0+, never backported to 8.5.78. The attack chain (user-provided error data \u2192 manipulated JSON output) cannot complete because JSON error reporting does not exist in the target. Verdict: not_affected per Rule 5 Type A2 (input received but chain to Goal broken by missing JSON generation).", "justification": "code_not_reachable" } }, { "id": "CVE-2023-28708", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:1e8c3c0e-2bfe-59dc-8f4f-7f7127e12e64", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-28708 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2023-41080", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:85d9c9d3-3edc-5a32-85f2-d0ae16ac1896", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-41080 is fixed in version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2023-42795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:3c1318dc-4d7d-5fce-be87-a205b78848ee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-42795 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2023-44487", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:69989008-9cdf-5ab5-aebd-13787316c1cf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-44487 is fixed in version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2023-45648", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:b3646d68-631a-566c-98a7-7d5d394c3072", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-45648 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2023-46589", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:84769a85-6b11-5cf7-8a5c-c9cffa3458b8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-46589 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2024-23672", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:95ec8558-6fae-5cec-8655-fdfa042abc46", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-23672 is fixed in version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2024-24549", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:b1960fe0-4184-546f-98fa-f2bbe3365cda", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-24549 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2024-34750", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:d979a276-f9ec-5e89-b7e3-a956caa5c1fa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-34750 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2024-38286", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:aad85d0b-86c4-59b5-b6e1-6d2f35a3fcfa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38286 is fixed in version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2024-50379", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:9c6715c2-e4d8-55a0-a1cf-5de7c0b4b095", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-50379 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2024-52316", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:6112c0f8-4ec4-5538-bd55-4a5fd899f703", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-52316 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2025-24813", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:c8770cd3-94a0-5e33-bef0-568dcd58d286", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-24813 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2025-31650", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:a5ac8c7a-566b-57fb-9fa4-a4f1792393a2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-31650 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-el-api. Apache Tomcat 8.5.78 is NOT AFFECTED by CVE-2025-31650. This vulnerability requires RFC 9218 HTTP Extensible Priorities support, which was not introduced until version 8.5.90. Version 8.5.78 lacks the Priority class, PRIORITY_UPDATE frame type, readPriorityUpdateFrame() method, and all priority header parsing code that contains the vulnerability. The CVE's affected version range (8.5.90-8.5.100) correctly excludes 8.5.78.", "justification": "code_not_present" } }, { "id": "CVE-2025-31651", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:2e1c01ce-75f1-5d85-ad48-da238984e0a2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31651 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2025-46701", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:ed98d7ec-9c22-54b2-9366-25f83cbda789", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-46701 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2025-48988", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:1d487ec3-87d6-5636-945d-4e326ddf2f2d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-48988 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2025-49125", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:73aa0bab-82ac-51bb-b2e7-ba77ec99fbd0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49125 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2025-52434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:ed89492a-5d14-50d7-b6e0-d90cac1c424b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-52434 is fixed in version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2025-52520", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:5ed1372d-fb70-55de-aad4-beda5d5fd7a1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-52520 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2025-53506", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:a07765fc-02f3-5dc7-89f6-283049ddf6e7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-53506 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2025-55752", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:35ab1c37-1511-5207-91d8-5b445d6c924a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-55752 is fixed in version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2025-55754", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:f291dc33-823d-58ee-b332-b4ca0206f637", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-55754 is fixed in version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2025-61795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:af0532b1-e8e5-5430-a6a4-c2788e0e6eb6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-61795 is fixed in version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2025-66614", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:9ad4cb2c-c475-5e09-a38b-766df89691fa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66614 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2026-24733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:48f19ea2-c662-551c-945c-934e2339b5b5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-24733 is fixed in version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2026-24880", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:165c9d3d-4dac-5a47-ba27-09bb7f09fcb8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-24880 is fixed in version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2026-25854", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:807d32fa-e52b-5a38-b18e-c8468003deeb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25854 is fixed in version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2026-29146", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:46222502-d4ac-5a6f-aa13-d0ef6c5bfc7f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29146 is fixed in version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2026-32990", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:e5b2eefe-627a-5669-947f-864fc2bfb7c0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-32990 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-el-api. not_affected \u2014 Apache Tomcat 8.5.78 is not affected by CVE-2026-32990. The vulnerability requires the checkSni() method introduced in CVE-2025-66614, which was backported to version 8.5.100. Version 8.5.78 predates this feature and lacks the vulnerable code path entirely. The SNI validation framework that compares protocol hostname with SNI hostname does not exist in 8.5.78.", "justification": "code_not_present" } }, { "id": "CVE-2026-41284", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:9be09b19-887e-5b93-8e9e-6755e9cb09a2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41284 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2026-41293", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:11db241f-2dae-511e-a2a6-01c60f6e11ea", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41293 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2026-42498", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:ce05fe46-c762-5099-babc-0191b4d56214", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42498 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2026-43512", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:298ba5c4-ed73-5116-8937-7d64af84bb18", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43512 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2026-43513", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:7d9bf5c6-8bf6-5d69-9cb4-05a08266f35e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43513 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2026-43514", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:9e5239f8-ef89-5a02-b67a-6c98ae224482", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43514 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2026-43515", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:2da23d82-1108-595a-b2b6-021406951311", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43515 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2026-65182", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:65f02f8f-cc4c-5c0b-806f-3a19d17262bf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65182 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2026-65905", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:f24b09d8-4a18-5bc6-bb4b-57ea162973e1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65905 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-el-api." } }, { "id": "CVE-2026-68525", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:aa2f56d1-511e-5e7c-b4d6-2e50eaf465c1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-68525 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-el-api." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-el-api@8.5.78-tuxcare.2" } ] }