{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:3cafe778-8b1b-5d56-bebf-b9b25046a5d3", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat-i18n-cs", "purl": "pkg:maven/org.apache.tomcat/tomcat-i18n-cs@10.1.16-tuxcare.1", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-cs@10.1.16-tuxcare.1", "version": "10.1.16-tuxcare.1", "pedigree": { "ancestors": [ { "name": "tomcat-i18n-cs", "purl": "pkg:maven/org.apache.tomcat/tomcat-i18n-cs@10.1.16", "type": "library", "group": "org.apache.tomcat", "version": "10.1.16" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-23672", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-cs@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:3f6e772e-d31b-5078-904f-ac47ee43989e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-23672 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-cs." } }, { "id": "CVE-2024-24549", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-cs@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:39ef28c9-fe4b-5123-8799-bfddd5d5cf61", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-24549 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-cs." } }, { "id": "CVE-2024-34750", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-cs@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:cc2f6d26-0535-5fab-b1cd-57e39509ddee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34750 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-cs." } }, { "id": "CVE-2024-38286", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-cs@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:024ec16d-24b4-57cf-9d85-6bbea59930bb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38286 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-cs." } }, { "id": "CVE-2024-50379", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-cs@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:c4bdebaa-23d1-59cb-9aa2-545a641eb2d7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-50379 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-cs." } }, { "id": "CVE-2024-52316", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-cs@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:c7f069c8-c8c9-546f-b1b1-053689236a6d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-52316 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-cs." } }, { "id": "CVE-2024-54677", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-cs@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:19156dac-5fb8-53eb-9f2e-331ce320124f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-54677 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-cs." } }, { "id": "CVE-2024-56337", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-cs@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:618aa315-9bce-505d-b19d-9f031c4698be", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-56337 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-cs." } }, { "id": "CVE-2025-24813", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-cs@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:c38f7a50-4867-5f01-9aba-46c87d056356", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-24813 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-cs." } }, { "id": "CVE-2025-31650", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-cs@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:2f22e7b1-d0a3-589a-a69f-cd3b02ed3bfd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31650 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-cs." } }, { "id": "CVE-2025-31651", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-cs@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:6e60bf02-438c-5e78-8ce5-d79e265d30d4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31651 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-cs." } }, { "id": "CVE-2025-46701", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-cs@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:062786b0-4499-5e08-b111-9b36fbd4f848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-46701 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-cs." } }, { "id": "CVE-2025-48988", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-cs@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:b611e949-699d-5c75-ad56-b326a50fac70", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-48988 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-cs." } }, { "id": "CVE-2025-48989", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-cs@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:ca346cbf-02e0-55f2-b97e-b314d472f220", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48989 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-cs." } }, { "id": "CVE-2025-49124", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-cs@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:bae4fe9c-acfa-59f6-ae16-a09bc1d2df18", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49124 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-cs." } }, { "id": "CVE-2025-49125", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-cs@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:1c858e55-0428-5d60-bda4-6e2a8908cb0b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49125 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-cs." } }, { "id": "CVE-2025-52520", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-cs@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:af696dfc-8ec9-5e6b-8fcb-8f73a8321f4e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-52520 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-cs." } }, { "id": "CVE-2025-53506", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-cs@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:844f60ec-45f8-51a6-8da4-ce8ac699512b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-53506 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-cs." } }, { "id": "CVE-2025-55668", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-cs@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:7dcc4f79-974e-5b01-a46a-f37f7c361176", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55668 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-cs." } }, { "id": "CVE-2025-55752", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-cs@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:c3f8ab1f-9b6a-575c-802d-d04414da854f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-55752 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-cs. Version 10.1.16 is NOT vulnerable to CVE-2025-55752. The vulnerable code pattern (normalizing before decoding in RewriteValve) was introduced later in version 10.1.40. Version 10.1.16 uses a different code structure that does not call URLDecoder.decode after RequestUtil.normalize, thus the vulnerability is not present. The CVE advisory's version range \"10.1.0-M1 through 10.1.44\" is over-broad; only versions 10.1.40-10.1.44 contain the vulnerable pattern.", "justification": "code_not_present" } }, { "id": "CVE-2025-55754", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-cs@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:c6b61553-7826-5873-ba56-fa950469550a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55754 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-cs." } }, { "id": "CVE-2025-61795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-cs@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:133ee115-bba5-54bb-afa1-9a81dc060b20", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-61795 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-cs." } }, { "id": "CVE-2025-66614", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-cs@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:dacd18fb-d42c-521c-8ad1-51c6b4977ca1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66614 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-cs." } }, { "id": "CVE-2026-24733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-cs@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:a524aee2-f170-59c5-a11a-96e81af733f9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24733 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-cs." } }, { "id": "CVE-2026-24734", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-cs@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:51d1ff65-b284-5185-9c1f-90de538a49f9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24734 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-cs." } }, { "id": "CVE-2026-24880", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-cs@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:5109f401-dae3-5b03-8bfa-dc4685342e0d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24880 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-cs." } }, { "id": "CVE-2026-25854", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-cs@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:c379d658-b2ac-5968-bcc3-83a23cfb56b5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25854 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-cs." } }, { "id": "CVE-2026-29145", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-cs@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:853b74b0-c3b9-5b61-a2de-a39f4920ef0b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29145 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-cs." } }, { "id": "CVE-2026-29146", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-cs@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:b662b6c4-d719-5fc3-a13a-3363a314b430", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29146 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-cs." } }, { "id": "CVE-2026-32990", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-cs@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:1aefb704-f0fa-5296-bf46-937581610cf6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-32990 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-cs. not_affected \u2014 Apache Tomcat 10.1.16 is not affected by CVE-2026-32990. The vulnerability exists in the checkSni() method's incomplete fix for CVE-2025-66614, affecting versions 10.1.50-10.1.52. Version 10.1.16 predates the introduction of the strict SNI validation feature entirely - the checkSni method, strictSni field, and protocolHostName parameter do not exist in this version. The vulnerability pattern (c...", "justification": "code_not_present" } }, { "id": "CVE-2026-34483", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-cs@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:f6c651c4-5772-5be7-9b27-0084deebfdf7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34483 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-cs." } }, { "id": "CVE-2026-34487", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-cs@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:56c9e708-bf0a-5c96-8aa0-b0d038a0cc41", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34487 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-cs." } }, { "id": "CVE-2026-41284", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-cs@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:6a184a83-36e7-5655-aba2-2b49488cc48c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41284 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-cs." } }, { "id": "CVE-2026-41293", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-cs@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:8d01e45c-16cf-526d-a6c8-933375328c72", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41293 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-cs." } }, { "id": "CVE-2026-42498", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-cs@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:5669d0ee-8166-50e7-9f50-9563bc93a416", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42498 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-cs." } }, { "id": "CVE-2026-43512", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-cs@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:292aaf47-2dd0-5acc-bf93-d7f590f8d9b2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43512 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-cs." } }, { "id": "CVE-2026-43513", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-cs@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:2aaf510b-327d-52be-a6cc-1646b29ff207", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43513 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-cs." } }, { "id": "CVE-2026-43514", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-cs@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:db0371d8-bbbe-5daf-9ca6-93b1e8baf1a9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43514 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-cs." } }, { "id": "CVE-2026-43515", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-cs@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:60840067-e130-5364-98fd-65fcaac42484", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-43515 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-cs." } }, { "id": "CVE-2026-53434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-cs@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:4ee41511-429a-511b-937a-bb12ac5e65e7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53434 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-cs." } }, { "id": "CVE-2026-65182", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-cs@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:af8499e8-3ae1-59b0-9286-700234a34e0c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65182 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-cs." } }, { "id": "CVE-2026-65905", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-cs@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:aac2caad-82a4-5405-b14d-fc975f83b790", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65905 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-cs." } }, { "id": "CVE-2026-68525", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-cs@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:08838187-c19b-5c2b-9df1-700c86023db1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68525 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-cs." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-cs@10.1.16-tuxcare.1" } ] }