{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:2a11bfb2-2946-5bfe-a89d-6b8840e265ba", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat-ssi", "purl": "pkg:maven/org.apache.tomcat/tomcat-ssi@10.1.16-tuxcare.1", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-ssi@10.1.16-tuxcare.1", "version": "10.1.16-tuxcare.1", "pedigree": { "ancestors": [ { "name": "tomcat-ssi", "purl": "pkg:maven/org.apache.tomcat/tomcat-ssi@10.1.16", "type": "library", "group": "org.apache.tomcat", "version": "10.1.16" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-23672", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-ssi@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:1271ef08-0e9e-54c8-9826-d9844bb38d5b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-23672 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-ssi." } }, { "id": "CVE-2024-24549", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-ssi@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:cd115b5e-3497-54bb-a945-e95f1bcf3f2a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-24549 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-ssi." } }, { "id": "CVE-2024-34750", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-ssi@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:461ea4ab-8f4c-580a-9938-6d5d554e9468", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34750 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-ssi." } }, { "id": "CVE-2024-38286", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-ssi@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:14d5a5d1-51be-58f5-9880-92942755e5f6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38286 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-ssi." } }, { "id": "CVE-2024-50379", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-ssi@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:1779dd0a-c2a8-5e2e-9590-989536284e5a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-50379 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-ssi." } }, { "id": "CVE-2024-52316", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-ssi@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:dca191ed-40e7-5f3c-90c1-083c5a3d6aaf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-52316 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-ssi." } }, { "id": "CVE-2024-54677", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-ssi@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:53b17312-67ba-53b3-9625-b89325f8a62b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-54677 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-ssi." } }, { "id": "CVE-2024-56337", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-ssi@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:79cb3df5-99ac-54db-b3b9-6e0d351658db", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-56337 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-ssi." } }, { "id": "CVE-2025-24813", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-ssi@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:8d3c1e53-7e84-551b-a9be-47edb9fd6b3d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-24813 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-ssi." } }, { "id": "CVE-2025-31650", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-ssi@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:64a4caad-5cb2-57a7-a5c8-106d870083c6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31650 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-ssi." } }, { "id": "CVE-2025-31651", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-ssi@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:be64fad1-db2a-5802-ac26-521c2e371208", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31651 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-ssi." } }, { "id": "CVE-2025-46701", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-ssi@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:695d3be1-82fc-5f80-aa49-e5117ed9f911", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-46701 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-ssi." } }, { "id": "CVE-2025-48988", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-ssi@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:394ca7b5-ac80-543b-b90a-1022d3a5aca8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-48988 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-ssi." } }, { "id": "CVE-2025-48989", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-ssi@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:45449517-b3a1-540f-905b-cc28c43cf9fa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48989 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-ssi." } }, { "id": "CVE-2025-49124", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-ssi@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:bbdde5ce-16c7-55fe-b69d-da72df21b796", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49124 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-ssi." } }, { "id": "CVE-2025-49125", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-ssi@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:daac74f4-006d-5309-9226-b61049e6603a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49125 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-ssi." } }, { "id": "CVE-2025-52520", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-ssi@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:2f185687-1bf5-53eb-933c-4ca9d6c5b77e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-52520 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-ssi." } }, { "id": "CVE-2025-53506", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-ssi@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:992d2b8c-e46d-5a10-a939-16f2810efb23", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-53506 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-ssi." } }, { "id": "CVE-2025-55668", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-ssi@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:cef66861-39dc-52d3-8a82-9ce4de7eeb05", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55668 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-ssi." } }, { "id": "CVE-2025-55752", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-ssi@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:167ee9ae-383b-5e6f-ba54-c9b26067c13e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-55752 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-ssi. Version 10.1.16 is NOT vulnerable to CVE-2025-55752. The vulnerable code pattern (normalizing before decoding in RewriteValve) was introduced later in version 10.1.40. Version 10.1.16 uses a different code structure that does not call URLDecoder.decode after RequestUtil.normalize, thus the vulnerability is not present. The CVE advisory's version range \"10.1.0-M1 through 10.1.44\" is over-broad; only versions 10.1.40-10.1.44 contain the vulnerable pattern.", "justification": "code_not_present" } }, { "id": "CVE-2025-55754", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-ssi@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:e0baba39-3bd8-57b0-87fc-97badd5e5c7e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55754 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-ssi." } }, { "id": "CVE-2025-61795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-ssi@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:d60c822c-bbbd-563e-9264-94c00bedb1ab", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-61795 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-ssi." } }, { "id": "CVE-2025-66614", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-ssi@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:b1aaa3c2-cbc8-5970-a5e1-d3f04570b14f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66614 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-ssi." } }, { "id": "CVE-2026-24733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-ssi@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:34a62d0d-f336-55cb-b7b5-8c24d446d5e2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24733 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-ssi." } }, { "id": "CVE-2026-24734", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-ssi@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:a4bfe002-e4cb-5878-baae-1079dad97a49", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24734 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-ssi." } }, { "id": "CVE-2026-24880", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-ssi@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:6cefab7e-dbbd-5ead-bb05-dd12cf11db10", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24880 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-ssi." } }, { "id": "CVE-2026-25854", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-ssi@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:5ec5151a-2d3a-5d1a-810f-0e30cf3b16fb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25854 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-ssi." } }, { "id": "CVE-2026-29145", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-ssi@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:c859d560-8362-5465-98b8-ce133e4edcc7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29145 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-ssi." } }, { "id": "CVE-2026-29146", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-ssi@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:1aaaf08e-0065-5b05-bcef-bcf35ea861d6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29146 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-ssi." } }, { "id": "CVE-2026-32990", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-ssi@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:8bd08c55-7e6c-53d4-9122-601db4d795b6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-32990 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-ssi. not_affected \u2014 Apache Tomcat 10.1.16 is not affected by CVE-2026-32990. The vulnerability exists in the checkSni() method's incomplete fix for CVE-2025-66614, affecting versions 10.1.50-10.1.52. Version 10.1.16 predates the introduction of the strict SNI validation feature entirely - the checkSni method, strictSni field, and protocolHostName parameter do not exist in this version. The vulnerability pattern (c...", "justification": "code_not_present" } }, { "id": "CVE-2026-34483", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-ssi@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:e330b3e2-8183-5bec-933a-dc5bf60153a6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34483 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-ssi." } }, { "id": "CVE-2026-34487", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-ssi@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:9d563f83-17e6-5501-bcec-cbf2f12a800c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34487 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-ssi." } }, { "id": "CVE-2026-41284", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-ssi@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:e7d5f8a7-a43f-573b-b9c3-fb37b9f3c932", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41284 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-ssi." } }, { "id": "CVE-2026-41293", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-ssi@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:280531ec-84d4-5484-a42b-78ac373ced89", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41293 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-ssi." } }, { "id": "CVE-2026-42498", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-ssi@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:051d348e-84f9-5f22-b53d-763b76be415f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42498 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-ssi." } }, { "id": "CVE-2026-43512", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-ssi@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:8d7622c4-14b8-5636-8179-05bd32c22fae", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43512 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-ssi." } }, { "id": "CVE-2026-43513", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-ssi@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:4fc8aace-48f8-50f9-9c99-26741e4802ae", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43513 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-ssi." } }, { "id": "CVE-2026-43514", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-ssi@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:ae9114cd-a43a-536d-a4af-11e16d927063", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43514 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-ssi." } }, { "id": "CVE-2026-43515", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-ssi@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:c165c791-cf89-5034-ad51-a729b1975481", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-43515 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-ssi." } }, { "id": "CVE-2026-53434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-ssi@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:a67832b9-c6d8-51d3-aaff-9115767a11c1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53434 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-ssi." } }, { "id": "CVE-2026-65182", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-ssi@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:0932e6e0-35e5-53d8-8856-733d27f5d092", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65182 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-ssi." } }, { "id": "CVE-2026-65905", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-ssi@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:1b7f7dbb-598b-5bfc-abe9-f9b1a37d8f3e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65905 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-ssi." } }, { "id": "CVE-2026-68525", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-ssi@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:27d0da06-2bff-5202-9775-f81ed37f9399", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68525 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-ssi." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-ssi@10.1.16-tuxcare.1" } ] }