{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:08937ad5-d6ed-53bb-b7ba-1da126f55a68", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat-annotations-api", "purl": "pkg:maven/org.apache.tomcat/tomcat-annotations-api@7.0.109-tuxcare.6", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-annotations-api@7.0.109-tuxcare.6", "version": "7.0.109-tuxcare.6", "pedigree": { "ancestors": [ { "name": "tomcat-annotations-api", "purl": "pkg:maven/org.apache.tomcat/tomcat-annotations-api@7.0.109", "type": "library", "group": "org.apache.tomcat", "version": "7.0.109" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2013-4590", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-annotations-api@7.0.109-tuxcare.6" } ], "bom-ref": "urn:uuid:6f331a32-78e1-5c71-9511-8fc9a6b2fd95", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-4590 does not affect version 7.0.109-tuxcare.6 of org.apache.tomcat:tomcat-annotations-api. Tomcat 7.0.109 is not vulnerable as it is outside the affected ranges: [0, 6.0.37]", "justification": "code_not_present" } }, { "id": "CVE-2015-5174", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-annotations-api@7.0.109-tuxcare.6" } ], "bom-ref": "urn:uuid:4d533ade-5ed5-5157-a497-87677e4812cb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2015-5174 does not affect version 7.0.109-tuxcare.6 of org.apache.tomcat:tomcat-annotations-api. not_affected \u2014 CVE-2015-5174 is not present in Tomcat 7.0.109-tuxcare.4. The upstream Apache fix (commit 90ca468fc6, April 2016) was already included in the official Tomcat 7.0.109 release (April 2021) before TuxCare adopted the repository. The fix uses an alternative approach (addedTrailingSlash logic) compared to the trunk patch (78688b0a30), but achieves the same security goal by preventing directory trave...", "justification": "code_not_present" } }, { "id": "CVE-2015-5346", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-annotations-api@7.0.109-tuxcare.6" } ], "bom-ref": "urn:uuid:6c106e64-f965-5f93-bd4b-d3052cadf60b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5346 affects version 7.0.109-tuxcare.6 of org.apache.tomcat:tomcat-annotations-api." } }, { "id": "CVE-2016-0706", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-annotations-api@7.0.109-tuxcare.6" } ], "bom-ref": "urn:uuid:13f2b2a1-2c9c-540c-880d-a933371c7e09", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-0706 does not affect version 7.0.109-tuxcare.6 of org.apache.tomcat:tomcat-annotations-api. Tomcat 7.0.109 is not vulnerable as it is outside the affected ranges: [6.0.0, 6.0.45), [8.0.0.RC1, 8.0.31), [9.0.0.M1, 9.0.0.M2)", "justification": "code_not_present" } }, { "id": "CVE-2016-0763", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-annotations-api@7.0.109-tuxcare.6" } ], "bom-ref": "urn:uuid:0f01fef1-b3d2-5b2e-bc4f-a3d9faa03ac5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-0763 does not affect version 7.0.109-tuxcare.6 of org.apache.tomcat:tomcat-annotations-api. CVE-2016-0763 affects Apache Tomcat 7.0.0-7.0.67", "justification": "code_not_present" } }, { "id": "CVE-2016-6817", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-annotations-api@7.0.109-tuxcare.6" } ], "bom-ref": "urn:uuid:774c45e1-2560-5982-8a74-cadd1e8a3526", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-6817 does not affect version 7.0.109-tuxcare.6 of org.apache.tomcat:tomcat-annotations-api. Version 7.0.109 is not vulnerable. Summary: Target repository is Tomcat 7.0.109-tuxcare.1, which does not have HTTP/2 support. CVE-2016-6817 affects the HTTP/2 header parser in Tomcat 9.0.0.M1 to 9.0.0.M11 and 8.5.0 to 8.5.6. Since HTTP/2 support was first introduced in Tomcat 8.5 and 9.0, and the target is running Tomcat 7.0.x, the vulnerable component (java/org/apache/coyote/http2/Http2Parser.java) does not exist in this codebase. Therefore, the vulnerability cannot exist.", "justification": "code_not_present" } }, { "id": "CVE-2016-8747", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-annotations-api@7.0.109-tuxcare.6" } ], "bom-ref": "urn:uuid:2a10fbbb-ae47-5524-8f9f-935d354a2297", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-8747 does not affect version 7.0.109-tuxcare.6 of org.apache.tomcat:tomcat-annotations-api. Version 7.0.109 is not vulnerable. Summary: CVE-2016-8747 does not affect the target repository. The target is Tomcat 7.0.109, which uses a fundamentally different architecture (byte arrays with System.arraycopy) that predates the vulnerable ByteBuffer refactoring introduced in Tomcat 8.5.7. The vulnerable class Http11InputBuffer.java does not exist in Tomcat 7.x.", "justification": "code_not_present" } }, { "id": "CVE-2017-5650", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-annotations-api@7.0.109-tuxcare.6" } ], "bom-ref": "urn:uuid:b50bb50e-402f-5db2-a261-8ca733b7ca32", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-5650 does not affect version 7.0.109-tuxcare.6 of org.apache.tomcat:tomcat-annotations-api. Version 7.0.109 is not vulnerable. Summary: Target repository (Apache Tomcat 7.0.109) does not contain HTTP/2 implementation. CVE-2017-5650 affects HTTP/2 GOAWAY frame handling in Tomcat 8.5.0-8.5.12 and 9.0.0.M1-9.0.0.M18. HTTP/2 support was first introduced in Tomcat 8.5.0, so Tomcat 7.x completely predates the vulnerable feature.", "justification": "code_not_present" } }, { "id": "CVE-2017-7675", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-annotations-api@7.0.109-tuxcare.6" } ], "bom-ref": "urn:uuid:757222a1-81e1-50d1-b0be-c13f8b9cb1ec", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-7675 does not affect version 7.0.109-tuxcare.6 of org.apache.tomcat:tomcat-annotations-api. Version 7.0.109 is not vulnerable. Summary: Target repository is Tomcat 7.0.109, which does not contain HTTP/2 support. The vulnerability CVE-2017-7675 is specific to the HTTP/2 implementation that was introduced in Tomcat 8.5.0 and 9.0.0.M1. Since the vulnerable feature (HTTP/2) was never introduced in Tomcat 7.x, the target is not vulnerable.", "justification": "code_not_present" } }, { "id": "CVE-2026-34486", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-annotations-api@7.0.109-tuxcare.6" } ], "bom-ref": "urn:uuid:a53c1c46-1beb-54d8-9ac3-d6459985b253", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34486 is fixed in version 7.0.109-tuxcare.6 of org.apache.tomcat:tomcat-annotations-api." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-annotations-api@7.0.109-tuxcare.6" } ] }