{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:41b12414-c9e9-5740-bfef-85f4e30e18dc", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat-websocket", "purl": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.55-tuxcare.1", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.55-tuxcare.1", "version": "10.1.55-tuxcare.1", "pedigree": { "ancestors": [ { "name": "tomcat-websocket", "purl": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.55", "type": "library", "group": "org.apache.tomcat", "version": "10.1.55" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-23672", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:1fb1dcfb-4006-554b-b12f-6079c0425734", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-23672 does not affect version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-websocket. not_affected \u2014 Apache Tomcat 10.1.55 is NOT affected by CVE-2024-23672. The vulnerability (incomplete WebSocket session cleanup leading to DoS) was fixed in upstream Apache Tomcat 10.1.19 and later versions. The target version 10.1.55 contains the complete fix, which was introduced by upstream commit 0052b37468 (authored by Mark Thomas, markt@apache.org, on 2024-01-18). This fix was already present in the ups...", "justification": "code_not_present" } }, { "id": "CVE-2024-24549", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:bfef229f-968d-540a-81d8-1227fe2cdc6a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-24549 does not affect version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-websocket. The target Apache Tomcat 10.1.55 is NOT vulnerable to CVE-2024-24549. The vulnerability was fixed in upstream Tomcat 10.1.19 (released 2024-02-19), and version 10.1.55 includes this fix. The fix moves HTTP/2 header validation to occur after each frame (HEADERS and CONTINUATION) rather than delaying until all headers are complete, preventing resource exhaustion from oversized headers. The fix commit (d07c82194e by markt@apache.org) is present in the target's git history and was part of the upstream release onboarded by TuxCare.", "justification": "code_not_present" } }, { "id": "CVE-2024-52316", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:362409ac-9139-58b7-a662-5a68030e5fec", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-52316 does not affect version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-websocket. CVE-2024-52316 affects Apache Tomcat 10.1.0-M1 through 10.1.30. The target is version 10.1.55, which already contains the upstream fix authored by Mark Thomas in commit acc2f01395. The fix adds explicit HTTP 500 status setting when Jakarta Authentication fails with an exception, preventing authentication bypass. This fix shipped in upstream release 10.1.31 and was included when TuxCare onboarded version 10.1.55.", "justification": "code_not_present" } }, { "id": "CVE-2025-48988", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:97b9fd10-770f-5597-9277-726a50edbad3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-48988 does not affect version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-websocket. CVE-2025-48988 affects Apache Tomcat 10.1.0-M1 through 10.1.41 and was fixed in 10.1.42. The target repository is version 10.1.55, which already contains the upstream fix (commit cdde8e655b by Apache developer Mark Thomas). The fix adds two resource limits for multipart/form-data requests: maxPartCount (default 50) and maxPartHeaderSize (default 512 bytes), preventing unbounded resource allocation. These limits are enforced in Request.parseParts() via Apache Commons FileUpload. The fix was part of the upstream Apache Tomcat 10.1.55 release that TuxCare onboarded, not a separate TuxCare backport.", "justification": "code_not_present" } }, { "id": "CVE-2025-49125", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:80cb70da-a3b8-5b8a-8217-2915e67ac5d1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-49125 does not affect version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-websocket. Apache Tomcat 10.1.55 is not affected by CVE-2025-49125. The vulnerability was fixed in upstream version 10.1.42, and version 10.1.55 already contains the fix. The fix introduces an isPathMounted() method that validates the character following the mount point prefix is either end-of-string or a '/' separator, preventing prefix-collision attacks on PreResources and PostResources. This is an upstream fix authored by Mark Thomas (markt@apache.org) that shipped in the upstream release onboarded by TuxCare.", "justification": "code_not_present" } }, { "id": "CVE-2026-24880", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:dc7aa0b4-eec7-5521-b07f-96873376ef46", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-24880 does not affect version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-websocket. CVE-2026-24880 (HTTP Request Smuggling via invalid chunk extension) is NOT present in Tomcat 10.1.55. The vulnerability required proper validation of chunk extension syntax to prevent inconsistent interpretation between HTTP processors. The upstream fix (commits f07df938d0 and 1e71441a15 by Mark Thomas) introduced a ChunkExtension.parse() state machine parser that validates chunk extensions according to RFC specifications. This fix was already included in the upstream Apache Tomcat 10.1.55 release, which TuxCare subsequently onboarded. The target code contains the complete fix: ChunkExtension.java with the state machine parser exists, and ChunkedInputFilter.java correctly uses ChunkExtension.parse() to validate all chunk extensions in both parseChunkHeader() and skipChunkHeader() methods.", "justification": "code_not_present" } }, { "id": "CVE-2026-29146", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:bb721bb5-fea4-534b-b8b1-96ae506f746f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-29146 does not affect version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-websocket. Target version 10.1.55 is not affected by CVE-2026-29146. The CVE affects Apache Tomcat versions through 10.1.52, with fixes shipped in 10.1.53+. The target contains upstream fixes (commits 607ebc0fa5 and 55f3eb9148 by markt@apache.org) that mitigate the padding oracle vulnerability through improved error handling and algorithm validation. The error handling ensures all decryption failures are handled uniformly (message dropped, error logged), preventing attackers from distinguishing padding errors from other decryption failures. Algorithm validation warns users that CBC/PKCS5Padding is not recommended and suggests switching to AES/GCM/NoPadding. Both fixes were present in the upstream 10.1.55 release before TuxCare onboarded it.", "justification": "code_not_present" } }, { "id": "CVE-2026-32990", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:cc2f5a5c-a9a7-5fc3-9533-de277ae858c9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-32990 does not affect version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-websocket. not_affected \u2014 CVE-2026-32990 is NOT present in Apache Tomcat 10.1.55. The fix for this vulnerability (normalizing HTTP Host header to lowercase before SSL configuration lookup) was already included in the upstream Apache Tomcat 10.1.55 release. The target version 10.1.55 is newer than the CVE's affected range (10.1.50-10.1.52), and the fix commit by remm@apache.org is present in HEAD, predating all TuxCare o...", "justification": "code_not_present" } }, { "id": "CVE-2026-53434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:e8487f57-b779-58ce-a8b4-91c1d0cbfef3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53434 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-websocket." } }, { "id": "CVE-2026-65182", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:33ed463e-3088-51f7-845c-028f1137a9f0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65182 is fixed in version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-websocket." } }, { "id": "CVE-2026-65905", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:bc78654a-e6e2-54f5-a7ab-ca8956fd5f92", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65905 is fixed in version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-websocket." } }, { "id": "CVE-2026-68525", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:f036abb6-52ad-5c28-9de4-5e5017d133b0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68525 is fixed in version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-websocket." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.55-tuxcare.1" } ] }