{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:bdf395f7-2617-540e-84ef-df63f5434899", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat-i18n-ru", "purl": "pkg:maven/org.apache.tomcat/tomcat-i18n-ru@10.1.16-tuxcare.1", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ru@10.1.16-tuxcare.1", "version": "10.1.16-tuxcare.1", "pedigree": { "ancestors": [ { "name": "tomcat-i18n-ru", "purl": "pkg:maven/org.apache.tomcat/tomcat-i18n-ru@10.1.16", "type": "library", "group": "org.apache.tomcat", "version": "10.1.16" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-23672", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ru@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:03947a4d-a38f-5324-95cf-f10c09acb8fa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-23672 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ru." } }, { "id": "CVE-2024-24549", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ru@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:06ff48c4-ba63-54f0-a8b9-1f3eaa066724", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-24549 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ru." } }, { "id": "CVE-2024-34750", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ru@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:010d6adf-31a0-523b-b7d1-763f8c95d71e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34750 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ru." } }, { "id": "CVE-2024-38286", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ru@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:abc31a57-9122-5ef0-81f6-b83b192f101b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38286 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ru." } }, { "id": "CVE-2024-50379", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ru@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:06946ece-1d56-5009-bd4a-22f1328c0c8d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-50379 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ru." } }, { "id": "CVE-2024-52316", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ru@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:6f03f470-7a81-5eb2-8be1-a85e3081adae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-52316 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ru." } }, { "id": "CVE-2024-54677", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ru@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:53324618-f7bd-52aa-8638-72438f345112", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-54677 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ru." } }, { "id": "CVE-2024-56337", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ru@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:1d7a5bb3-1c04-5a88-b040-f4558804fa59", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-56337 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ru." } }, { "id": "CVE-2025-24813", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ru@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:f5760287-fd67-5525-bc9a-a46e365261d6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-24813 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ru." } }, { "id": "CVE-2025-31650", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ru@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:dcbbc417-8ad5-5fd8-adba-63252c166ccd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31650 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ru." } }, { "id": "CVE-2025-31651", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ru@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:7db3e2fb-4d6a-533a-ac71-2e6819df8514", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31651 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ru." } }, { "id": "CVE-2025-46701", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ru@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:af8782db-7483-5546-aaff-11234c7d3f03", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-46701 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ru." } }, { "id": "CVE-2025-48988", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ru@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:eba30b0c-5fc2-58c7-a502-f2f54c95ed68", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-48988 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ru." } }, { "id": "CVE-2025-48989", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ru@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:94bc89d8-c984-5d62-b98d-801cd6e48aad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48989 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ru." } }, { "id": "CVE-2025-49124", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ru@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:17f3ffc5-5caf-5384-84bc-f54b815f1d01", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49124 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ru." } }, { "id": "CVE-2025-49125", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ru@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:3de49b97-58e3-562c-b18c-121c7a766754", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49125 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ru." } }, { "id": "CVE-2025-52520", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ru@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:304de33f-d5fa-5657-9172-33d52950d943", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-52520 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ru." } }, { "id": "CVE-2025-53506", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ru@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:bb512d9d-600c-5bb6-9eb3-730937102ce8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-53506 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ru." } }, { "id": "CVE-2025-55668", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ru@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:cf4b170b-dfb1-5e36-a37d-ce0160ff8cdd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55668 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ru." } }, { "id": "CVE-2025-55752", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ru@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:a0277a65-09a2-5931-832a-a23dd4d4fb18", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-55752 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ru. Version 10.1.16 is NOT vulnerable to CVE-2025-55752. The vulnerable code pattern (normalizing before decoding in RewriteValve) was introduced later in version 10.1.40. Version 10.1.16 uses a different code structure that does not call URLDecoder.decode after RequestUtil.normalize, thus the vulnerability is not present. The CVE advisory's version range \"10.1.0-M1 through 10.1.44\" is over-broad; only versions 10.1.40-10.1.44 contain the vulnerable pattern.", "justification": "code_not_present" } }, { "id": "CVE-2025-55754", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ru@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:3774e768-6413-5f7c-ae85-801420bc2469", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55754 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ru." } }, { "id": "CVE-2025-61795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ru@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:cf01487f-cc7d-5be6-aa49-211035397f51", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-61795 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ru." } }, { "id": "CVE-2025-66614", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ru@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:dfc68b30-91a8-52a6-8813-a384caa1e1c4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66614 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ru." } }, { "id": "CVE-2026-24733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ru@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:cf8bca1c-6110-5fa9-a649-9e39c9902f8e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24733 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ru." } }, { "id": "CVE-2026-24734", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ru@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:2776280b-42c4-5282-9897-16822a505854", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24734 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ru." } }, { "id": "CVE-2026-24880", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ru@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:8bda9123-8f24-5ec4-9ab2-d03b3fc56e63", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24880 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ru." } }, { "id": "CVE-2026-25854", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ru@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:5aa1843c-f14e-5b08-8b6e-d954b2462cac", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25854 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ru." } }, { "id": "CVE-2026-29145", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ru@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:e534ef11-727e-5c8f-8579-dde87d32fe67", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29145 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ru." } }, { "id": "CVE-2026-29146", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ru@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:867553bc-d234-5bb3-ad9a-76b80865d91e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29146 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ru." } }, { "id": "CVE-2026-32990", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ru@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:55de6756-2f9e-50ef-be45-d24df044d8f5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-32990 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ru. not_affected \u2014 Apache Tomcat 10.1.16 is not affected by CVE-2026-32990. The vulnerability exists in the checkSni() method's incomplete fix for CVE-2025-66614, affecting versions 10.1.50-10.1.52. Version 10.1.16 predates the introduction of the strict SNI validation feature entirely - the checkSni method, strictSni field, and protocolHostName parameter do not exist in this version. The vulnerability pattern (c...", "justification": "code_not_present" } }, { "id": "CVE-2026-34483", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ru@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:4233f404-7d67-5ad5-8d72-0d037bf84913", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34483 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ru." } }, { "id": "CVE-2026-34487", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ru@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:9859aaf5-96b0-5b48-9700-a4342042a264", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34487 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ru." } }, { "id": "CVE-2026-41284", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ru@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:197d5dc3-724e-5b1f-8899-9e920f408d06", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41284 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ru." } }, { "id": "CVE-2026-41293", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ru@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:f922a061-0e04-5281-82ad-e482bbe120c5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41293 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ru." } }, { "id": "CVE-2026-42498", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ru@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:a924683d-b452-59ca-82b6-3ceb851a4c1e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42498 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ru." } }, { "id": "CVE-2026-43512", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ru@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:ee1357a3-b861-59b8-8959-a3c53b44eb61", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43512 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ru." } }, { "id": "CVE-2026-43513", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ru@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:63c5dc07-bbfa-570d-9fc3-dacae9e53809", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43513 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ru." } }, { "id": "CVE-2026-43514", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ru@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:20b32dec-1214-5b11-a0ee-3258d00af5b9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43514 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ru." } }, { "id": "CVE-2026-43515", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ru@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:312e82d7-75e1-5a75-8145-d0a8e13b3810", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-43515 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ru." } }, { "id": "CVE-2026-53434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ru@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:546b013c-61f4-54e1-b049-4221106907e1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53434 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ru." } }, { "id": "CVE-2026-65182", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ru@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:168cdbdb-3b5e-523a-829f-1e28cd973435", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65182 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ru." } }, { "id": "CVE-2026-65905", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ru@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:27f6ebda-4d9e-5877-b381-e619191f9ed4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65905 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ru." } }, { "id": "CVE-2026-68525", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ru@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:9f95dc14-2161-5a5d-98f4-5cd7c6ac1fbe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68525 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-i18n-ru." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-i18n-ru@10.1.16-tuxcare.1" } ] }