{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:26c94fa6-b66f-52ef-97af-25530632da42", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat-i18n-ko", "purl": "pkg:maven/org.apache.tomcat/tomcat-i18n-ko@10.1.16-tuxcare.1", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ko@10.1.16-tuxcare.1", "version": "10.1.16-tuxcare.1", "pedigree": { "ancestors": [ { "name": "tomcat-i18n-ko", "purl": "pkg:maven/org.apache.tomcat/tomcat-i18n-ko@10.1.16", "type": "library", "group": "org.apache.tomcat", "version": "10.1.16" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-23672", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ko@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:7bd3f41b-95e4-547d-89b8-4f83b4059c18", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-23672 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ko." } }, { "id": "CVE-2024-24549", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ko@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:61db80b5-bfc5-565d-b259-903108ed46dd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-24549 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ko." } }, { "id": "CVE-2024-34750", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ko@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:f600df03-427f-5db9-948e-698c18bb19f0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34750 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ko." } }, { "id": "CVE-2024-38286", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ko@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:551ff1af-34d3-5418-9374-2bcc4b9f7826", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38286 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ko." } }, { "id": "CVE-2024-50379", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ko@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:653327b8-7e86-5dab-ad0a-c57814158e9b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-50379 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ko." } }, { "id": "CVE-2024-52316", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ko@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:7f381121-9ca7-5c34-9290-6252f91fcd51", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-52316 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ko." } }, { "id": "CVE-2024-54677", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ko@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:e9b832a3-76dd-59d4-bb5d-e16134612f99", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-54677 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ko." } }, { "id": "CVE-2024-56337", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ko@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:b85972a6-db9e-5527-a660-df467b207306", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-56337 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ko." } }, { "id": "CVE-2025-24813", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ko@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:9b2138bf-cdf9-5dc5-97ea-000c457c020a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-24813 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ko." } }, { "id": "CVE-2025-31650", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ko@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:5eb3d9e5-73b9-5ab3-85b2-660d84367c70", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31650 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ko." } }, { "id": "CVE-2025-31651", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ko@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:d04f7995-a729-5832-9d3e-9d098eb12bb5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31651 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ko." } }, { "id": "CVE-2025-46701", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ko@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:4bac3f1b-bba9-5617-ae5c-5f57f3ead54e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-46701 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ko." } }, { "id": "CVE-2025-48988", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ko@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:f4909c38-9d73-5595-8e61-2348ea188f4e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-48988 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ko." } }, { "id": "CVE-2025-48989", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ko@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:dac51b83-84a2-593d-811a-d07ac4544293", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48989 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ko." } }, { "id": "CVE-2025-49124", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ko@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:00f8a317-f84a-59c1-8c09-9b2d901a3fc9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49124 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ko." } }, { "id": "CVE-2025-49125", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ko@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:9f9dac29-8075-50df-b1a9-20bd5dd50e13", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49125 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ko." } }, { "id": "CVE-2025-52520", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ko@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:a6334c39-c18b-5995-b59e-feef44dc99dc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-52520 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ko." } }, { "id": "CVE-2025-53506", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ko@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:15e65b3e-b4e1-5e17-89f6-6b0f4e16bb01", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-53506 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ko." } }, { "id": "CVE-2025-55668", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ko@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:0a8c2f8e-6324-5827-b248-6f544488d3de", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55668 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ko." } }, { "id": "CVE-2025-55752", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ko@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:b0eb4500-b3fa-554e-bba9-ba1d817a143b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-55752 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ko. Version 10.1.16 is NOT vulnerable to CVE-2025-55752. The vulnerable code pattern (normalizing before decoding in RewriteValve) was introduced later in version 10.1.40. Version 10.1.16 uses a different code structure that does not call URLDecoder.decode after RequestUtil.normalize, thus the vulnerability is not present. The CVE advisory's version range \"10.1.0-M1 through 10.1.44\" is over-broad; only versions 10.1.40-10.1.44 contain the vulnerable pattern.", "justification": "code_not_present" } }, { "id": "CVE-2025-55754", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ko@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:e3eaee91-4c67-5c75-bb8f-13aa163d1e6f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55754 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ko." } }, { "id": "CVE-2025-61795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ko@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:1b52c297-a210-58d9-9e53-0ea1794a46b6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-61795 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ko." } }, { "id": "CVE-2025-66614", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ko@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:485f02ca-3d7d-5a8b-b859-6271518ab152", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66614 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ko." } }, { "id": "CVE-2026-24733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ko@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:09b7756c-ccf2-5dab-ab82-ea862e152f3f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24733 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ko." } }, { "id": "CVE-2026-24734", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ko@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:b5b8f752-d3c2-57f2-812f-8db559195055", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24734 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ko." } }, { "id": "CVE-2026-24880", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ko@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:f149c756-2deb-57cf-b170-9015991cab4f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24880 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ko." } }, { "id": "CVE-2026-25854", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ko@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:c374e00d-9ceb-5cad-9f1e-96058fc6bffd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25854 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ko." } }, { "id": "CVE-2026-29145", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ko@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:b0b1f2df-e76d-5efb-88b1-84fc230c0cd9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29145 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ko." } }, { "id": "CVE-2026-29146", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ko@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:ace66e7d-a789-57c6-b592-9607fe5d136d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29146 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ko." } }, { "id": "CVE-2026-32990", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ko@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:f3ebf4d4-0adf-5260-bd40-fe149f409d06", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-32990 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ko. not_affected \u2014 Apache Tomcat 10.1.16 is not affected by CVE-2026-32990. The vulnerability exists in the checkSni() method's incomplete fix for CVE-2025-66614, affecting versions 10.1.50-10.1.52. Version 10.1.16 predates the introduction of the strict SNI validation feature entirely - the checkSni method, strictSni field, and protocolHostName parameter do not exist in this version. The vulnerability pattern (c...", "justification": "code_not_present" } }, { "id": "CVE-2026-34483", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ko@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:3b6ba37b-b825-5b86-9791-9fb1519983da", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34483 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ko." } }, { "id": "CVE-2026-34487", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ko@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:2e0d88e6-9d84-5f43-a308-7c26a1885705", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34487 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ko." } }, { "id": "CVE-2026-41284", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ko@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:1ea332c5-3a64-578a-a965-161e6be70a93", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41284 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ko." } }, { "id": "CVE-2026-41293", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ko@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:b28c5e0d-3a1a-5920-b754-06198e5d6e72", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41293 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ko." } }, { "id": "CVE-2026-42498", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ko@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:25f2e782-0f00-51a1-94be-b63da75c7960", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42498 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ko." } }, { "id": "CVE-2026-43512", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ko@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:05fa2222-5b0a-5dc4-bd9b-7bd2564cb545", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43512 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ko." } }, { "id": "CVE-2026-43513", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ko@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:bd19eca0-1b33-5c6d-995a-90260f7b8644", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43513 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ko." } }, { "id": "CVE-2026-43514", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ko@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:495044d1-ff27-5680-8915-0a87fc39f958", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43514 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ko." } }, { "id": "CVE-2026-43515", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ko@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:f641c45c-381a-55b9-9cfa-c7b8582285d1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-43515 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ko." } }, { "id": "CVE-2026-53434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ko@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:37f65e96-277a-518c-ae36-a3c1315840e9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53434 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ko." } }, { "id": "CVE-2026-65182", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ko@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:67bc579a-f4b5-52ec-ad49-195abcfa5d67", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65182 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ko." } }, { "id": "CVE-2026-65905", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ko@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:fab05594-e42c-5ea6-abaa-4176234057c3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65905 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ko." } }, { "id": "CVE-2026-68525", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ko@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:1b538a7a-475f-5ba6-983e-682112b90427", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68525 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ko." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ko@10.1.16-tuxcare.1" } ] }