{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:a7d92969-2447-5c76-8cac-e75f8a1f7647", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat-storeconfig", "purl": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.16-tuxcare.1", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.16-tuxcare.1", "version": "10.1.16-tuxcare.1", "pedigree": { "ancestors": [ { "name": "tomcat-storeconfig", "purl": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.16", "type": "library", "group": "org.apache.tomcat", "version": "10.1.16" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-23672", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:84ccd897-2e20-5a78-bd88-742261dda08c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-23672 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2024-24549", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:0003d6f1-0cf2-5199-9090-7ebb8fe2aedf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-24549 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2024-34750", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:aae48a20-77fd-5b97-bc8c-3caf0772571d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34750 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2024-38286", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:09896a3a-de9a-52e6-8b68-9099ce09fade", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38286 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2024-50379", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:8a4d4f3d-1c71-5eee-ab8e-8773320c365c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-50379 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2024-52316", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:da65cfc1-71af-5d3d-8c14-c13a3a70be99", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-52316 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2024-54677", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:bf7b2249-71e7-553e-9fe8-96bce6785e2a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-54677 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2024-56337", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:b4c8b24e-65b9-5fcb-a687-f58d62d70539", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-56337 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2025-24813", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:0cc54b61-b340-58c3-b299-647ebc575750", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-24813 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2025-31650", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:d8f3b422-d9af-533a-9454-3712e379a4b8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31650 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2025-31651", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:c45489ec-ef31-5b22-9f59-62d8e556577e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31651 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2025-46701", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:c0af3543-876b-58b5-8469-2788b849060e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-46701 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2025-48988", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:10ed7e86-7e8a-536c-8bca-8ef00109fe05", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-48988 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2025-48989", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:82a4feb4-4514-552c-bc6b-1fa2083d3ac1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48989 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2025-49124", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:0f12cb91-a1ac-5315-ba23-66eeaf8ac401", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49124 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2025-49125", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:3ad30ab6-d58e-560d-9c57-d524e6284a87", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49125 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2025-52520", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:369b882e-7e4a-51f8-b2b2-e14d4a9d2914", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-52520 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2025-53506", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:e8196357-a3cd-5315-8572-817ed20766fc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-53506 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2025-55668", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:2ec9d142-dd43-55d5-b92c-dafcab60e341", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55668 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2025-55752", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:0c817407-fd8a-52fa-9381-27aff81ee375", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-55752 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig. Version 10.1.16 is NOT vulnerable to CVE-2025-55752. The vulnerable code pattern (normalizing before decoding in RewriteValve) was introduced later in version 10.1.40. Version 10.1.16 uses a different code structure that does not call URLDecoder.decode after RequestUtil.normalize, thus the vulnerability is not present. The CVE advisory's version range \"10.1.0-M1 through 10.1.44\" is over-broad; only versions 10.1.40-10.1.44 contain the vulnerable pattern.", "justification": "code_not_present" } }, { "id": "CVE-2025-55754", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:8bcfa681-d535-5b96-9cb4-71e2497520fb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55754 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2025-61795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:88c4f3d1-e991-5093-b494-a448cd299652", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-61795 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2025-66614", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:95784e0e-11f9-5b44-a265-fadbd958afbc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66614 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2026-24733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:5425d3a2-a29d-5cf1-9a0b-067b690749f8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24733 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2026-24734", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:d802a86e-2de5-5dd2-9d90-0d9c92d19fd6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24734 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2026-24880", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:2593b020-f53b-57bb-80fd-4ca690a781ac", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24880 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2026-25854", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:53fc70f8-11cb-5a7e-b3e1-c37606833ec0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25854 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2026-29145", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:29bde18d-6b8c-5a04-8f29-8430b9b1a1df", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29145 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2026-29146", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:6c5697b5-0e66-58b0-b358-58dac3903fa4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29146 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2026-32990", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:d42806d7-e597-5b21-9850-5bc2535448f7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-32990 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig. not_affected \u2014 Apache Tomcat 10.1.16 is not affected by CVE-2026-32990. The vulnerability exists in the checkSni() method's incomplete fix for CVE-2025-66614, affecting versions 10.1.50-10.1.52. Version 10.1.16 predates the introduction of the strict SNI validation feature entirely - the checkSni method, strictSni field, and protocolHostName parameter do not exist in this version. The vulnerability pattern (c...", "justification": "code_not_present" } }, { "id": "CVE-2026-34483", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:b04ec4d5-445d-5e29-bad6-3712c06e3a63", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34483 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2026-34487", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:9227c45d-5f7c-585f-aea4-831017ecbaf3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34487 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2026-41284", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:c79976a2-9f72-5baa-9b81-044fef348b66", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41284 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2026-41293", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:89feeb4b-44d4-528f-a1b4-6e3cf21e1dcf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41293 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2026-42498", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:3d1ac094-497b-5908-85d4-cab8a22f5e97", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42498 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2026-43512", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:3370f7be-1de3-5185-ae56-ae5047da8901", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43512 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2026-43513", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:8bb01f7c-c943-5a2a-80ea-7f8548d4d04f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43513 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2026-43514", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:487e1221-da46-50d5-ab17-315428d5c2b1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43514 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2026-43515", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:9829ce08-fbc7-5d1a-9112-2e395359eaf8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-43515 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2026-53434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:a3343983-e468-516e-82dc-e044202f7988", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53434 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2026-65182", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:9db43053-2273-5971-b41c-96d00600657c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65182 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2026-65905", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:3eb37f5b-64f2-594d-a8c4-beff428135da", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65905 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2026-68525", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:8305e020-95e1-5a6b-89ea-213b121f87f1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68525 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.16-tuxcare.1" } ] }