{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:138d4a8c-308c-5063-8858-2e719ab4c4bb", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat-i18n-fr", "purl": "pkg:maven/org.apache.tomcat/tomcat-i18n-fr@10.1.16-tuxcare.1", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-fr@10.1.16-tuxcare.1", "version": "10.1.16-tuxcare.1", "pedigree": { "ancestors": [ { "name": "tomcat-i18n-fr", "purl": "pkg:maven/org.apache.tomcat/tomcat-i18n-fr@10.1.16", "type": "library", "group": "org.apache.tomcat", "version": "10.1.16" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-23672", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-fr@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:aad5323c-95ec-5a85-8bad-cdc2b1427996", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-23672 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-fr." } }, { "id": "CVE-2024-24549", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-fr@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:f7fa8718-daf2-5322-b259-7cbc8cd5555b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-24549 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-fr." } }, { "id": "CVE-2024-34750", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-fr@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:1e8ae85c-dc75-5173-91f6-76957d08bca5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34750 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-fr." } }, { "id": "CVE-2024-38286", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-fr@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:edd148b9-113d-5116-b538-acd9a9ecec6d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38286 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-fr." } }, { "id": "CVE-2024-50379", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-fr@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:10535847-6399-5bb1-90c3-8b7e8f929616", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-50379 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-fr." } }, { "id": "CVE-2024-52316", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-fr@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:2c30cab6-0297-55b3-8aaa-15297ae03dc3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-52316 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-fr." } }, { "id": "CVE-2024-54677", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-fr@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:94e11db3-7c5d-5b47-ba36-7b8ef385786d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-54677 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-fr." } }, { "id": "CVE-2024-56337", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-fr@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:c9bc6473-a498-5580-8e09-8f1cb6c1685a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-56337 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-fr." } }, { "id": "CVE-2025-24813", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-fr@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:353c815d-dc72-5b69-b14d-dd7de004d80a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-24813 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-fr." } }, { "id": "CVE-2025-31650", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-fr@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:75b403c5-43f4-5701-ba32-446306dbf9ba", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31650 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-fr." } }, { "id": "CVE-2025-31651", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-fr@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:f9cee7b4-f894-514c-b965-fa4208a2d53e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31651 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-fr." } }, { "id": "CVE-2025-46701", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-fr@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:e48b775b-7888-5030-ad64-f1d80fea1d46", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-46701 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-fr." } }, { "id": "CVE-2025-48988", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-fr@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:1b1b2e46-bddf-5fa0-9121-6fa9af290997", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-48988 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-fr." } }, { "id": "CVE-2025-48989", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-fr@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:37465879-c12f-5d15-a742-6d85010c29a9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48989 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-fr." } }, { "id": "CVE-2025-49124", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-fr@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:d8591037-0389-546a-a408-4a4c2e4a0cd4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49124 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-fr." } }, { "id": "CVE-2025-49125", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-fr@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:61e6f0f0-0541-53dc-ab7f-6e77cd97ff74", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49125 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-fr." } }, { "id": "CVE-2025-52520", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-fr@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:5f348924-34fb-5bbc-be85-0aaba79b3b45", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-52520 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-fr." } }, { "id": "CVE-2025-53506", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-fr@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:82fa61ef-b146-5f43-ba49-d810d371a908", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-53506 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-fr." } }, { "id": "CVE-2025-55668", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-fr@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:bb2a63da-e3a4-5139-90a8-c1b4985f94bc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55668 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-fr." } }, { "id": "CVE-2025-55752", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-fr@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:35bb9ac3-424a-5551-a946-1c9ebc421e6b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-55752 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-fr. Version 10.1.16 is NOT vulnerable to CVE-2025-55752. The vulnerable code pattern (normalizing before decoding in RewriteValve) was introduced later in version 10.1.40. Version 10.1.16 uses a different code structure that does not call URLDecoder.decode after RequestUtil.normalize, thus the vulnerability is not present. The CVE advisory's version range \"10.1.0-M1 through 10.1.44\" is over-broad; only versions 10.1.40-10.1.44 contain the vulnerable pattern.", "justification": "code_not_present" } }, { "id": "CVE-2025-55754", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-fr@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:0474dab3-4f51-5a16-a635-8ba4c982c9c3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55754 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-fr." } }, { "id": "CVE-2025-61795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-fr@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:35de7720-7886-561b-9b4c-3a4ce00d35d7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-61795 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-fr." } }, { "id": "CVE-2025-66614", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-fr@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:16b18c19-f34d-539f-a6e0-aa9629c44669", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66614 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-fr." } }, { "id": "CVE-2026-24733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-fr@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:d1f4ec4c-64bf-50bc-87f3-96b3b9c380dd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24733 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-fr." } }, { "id": "CVE-2026-24734", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-fr@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:af749684-c953-5cec-8dca-e6fa7a6f395b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24734 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-fr." } }, { "id": "CVE-2026-24880", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-fr@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:2e7d2d13-579a-5466-aef8-9134dfff975a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24880 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-fr." } }, { "id": "CVE-2026-25854", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-fr@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:ba011408-502f-5391-97d1-7dfebe8b9d17", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25854 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-fr." } }, { "id": "CVE-2026-29145", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-fr@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:2f3ce89a-bf19-51c3-86b7-4060ce981026", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29145 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-fr." } }, { "id": "CVE-2026-29146", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-fr@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:22c42949-ec80-5153-8e13-e2f5034757ef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29146 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-fr." } }, { "id": "CVE-2026-32990", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-fr@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:370e4e09-54ea-542d-b417-5a4561a66965", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-32990 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-fr. not_affected \u2014 Apache Tomcat 10.1.16 is not affected by CVE-2026-32990. The vulnerability exists in the checkSni() method's incomplete fix for CVE-2025-66614, affecting versions 10.1.50-10.1.52. Version 10.1.16 predates the introduction of the strict SNI validation feature entirely - the checkSni method, strictSni field, and protocolHostName parameter do not exist in this version. The vulnerability pattern (c...", "justification": "code_not_present" } }, { "id": "CVE-2026-34483", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-fr@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:b0a808ec-dde2-5b09-9bf4-c80cc3f32212", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34483 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-fr." } }, { "id": "CVE-2026-34487", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-fr@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:a2cd0d77-8b94-5066-80a0-f8bc848e9c4f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34487 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-fr." } }, { "id": "CVE-2026-41284", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-fr@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:88d0ca30-aaf3-5f98-ad92-d436ad17aefb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41284 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-fr." } }, { "id": "CVE-2026-41293", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-fr@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:bef5462b-0a23-5dbf-99fa-8d20d3d31943", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41293 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-fr." } }, { "id": "CVE-2026-42498", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-fr@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:e55836b0-e41d-5f2a-bd60-50b63fa17fd9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42498 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-fr." } }, { "id": "CVE-2026-43512", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-fr@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:dc232847-5813-5ef4-8979-f07e12ae5e65", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43512 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-fr." } }, { "id": "CVE-2026-43513", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-fr@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:b2bf1673-f261-51a1-9337-2ae993ef8e26", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43513 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-fr." } }, { "id": "CVE-2026-43514", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-fr@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:845e52bd-12d9-562c-ab81-bb89a860ca71", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43514 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-fr." } }, { "id": "CVE-2026-43515", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-fr@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:ffcbd0c7-b177-5f15-9ae5-a9e0bdc37fdb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-43515 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-fr." } }, { "id": "CVE-2026-53434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-fr@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:1e3ae94d-f6e4-5a77-bcfd-db18f365d693", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53434 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-fr." } }, { "id": "CVE-2026-65182", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-fr@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:ab6f6fec-7bf7-5258-91c6-e8e84ebab150", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65182 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-fr." } }, { "id": "CVE-2026-65905", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-fr@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:1060a0db-8282-55c9-a5f2-6882d5432445", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65905 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-fr." } }, { "id": "CVE-2026-68525", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-fr@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:b60b24ed-8377-5caa-b364-96ff5280b219", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68525 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-fr." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-fr@10.1.16-tuxcare.1" } ] }