{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:81b5d544-f27a-5adc-9224-cc46f2d09110", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat-catalina-ha", "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@7.0.70-tuxcare.4", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@7.0.70-tuxcare.4", "version": "7.0.70-tuxcare.4", "pedigree": { "ancestors": [ { "name": "tomcat-catalina-ha", "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@7.0.70", "type": "library", "group": "org.apache.tomcat", "version": "7.0.70" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2012-5568", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:201d5042-72f6-5e7f-845f-e97f66e39152", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5568 affects version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ha and will not be fixed. Apache does not treat CVE-2012-5568 as a Tomcat vulnerability and ships no fix; mitigation is connector configuration.", "response": [ "will_not_fix" ] } }, { "id": "CVE-2016-5388", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:2af37ae7-c318-5df5-acef-c1407afebcd9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2016-5388 is fixed in version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2016-6816", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:9dadaf40-a270-57f0-b016-14419f46438c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2016-6816 is fixed in version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2016-8735", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:4508e3f7-7a2d-5a82-aa24-2b6a8b0abb08", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2016-8735 is fixed in version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2016-8745", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:cc978a3a-1f6e-5fb6-9569-9c4acee3b99d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2016-8745 is fixed in version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2017-12616", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:76aa687e-7424-513b-b52a-473620c3b81d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2017-12616 is fixed in version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2017-12617", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:807250a4-e7ae-59af-84e2-c6bcf30ffade", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-12617 affects version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ha, and is fixed in 7.0.70-tuxcare.5." } }, { "id": "CVE-2017-5648", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:ed410027-9207-5c7d-b172-2525ea2ee2c3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-5648 affects version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ha, and is fixed in 7.0.70-tuxcare.5." } }, { "id": "CVE-2019-0199", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:f0a9b269-1487-5881-a423-5ba7d5de0052", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-0199 affects version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2019-0221", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:8764984a-cb88-5bbc-8545-d6e756c6ad3d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-0221 is fixed in version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2019-2684", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:d300709a-081b-5f63-9ee7-4d939b553550", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-2684 is fixed in version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2020-13934", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:7d33184f-4aad-5c73-ae2a-fda1900b597d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-13934 does not affect version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ha. Tomcat 7.0.70 is not affected by CVE-2020-13934. The vulnerability requires HTTP/2 (h2c) protocol support to leak HTTP/1.1 processors during direct h2c connections. HTTP/2 support was first introduced in Tomcat 8.5/9.0 (circa 2016), and version 7.0.70 predates this feature entirely. The target codebase contains no HTTP/2 implementation, no h2c upgrade handling, and no UpgradeProtocol interface used by the vulnerable code pattern.", "justification": "code_not_present" } }, { "id": "CVE-2020-13943", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:7c174206-bbd0-52fc-a0a1-8830cd784db0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-13943 does not affect version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ha. not_affected \u2014 The target repository (Apache Tomcat 7.0.70 at commit a78de4bfa3) does not contain HTTP/2 protocol support. CVE-2020-13943 affects the HTTP/2 implementation in the org.apache.coyote.http2 package, which does not exist in this version. HTTP/2 support was introduced in Tomcat 8.5.0+; version 7.0.70 only supports HTTP/1.1 and AJP protocols. The vulnerability's attack vector (HTTP/2 HEADERS frames ...", "justification": "code_not_present" } }, { "id": "CVE-2020-17527", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:64a40122-274b-532c-972d-7ce306a230a9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-17527 affects version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2020-9484", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:db21806e-e354-50cd-8cb6-b75bc968daec", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-9484 is fixed in version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2022-42252", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:9fcfcbff-e519-5f62-bc36-de634edb0352", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-42252 affects version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2022-45143", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:8031ebb4-4e39-5d17-bfdd-335b65f5ed88", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-45143 does not affect version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ha. Tomcat 7.0.70 is not affected by CVE-2022-45143. The vulnerable component JsonErrorReportValve does not exist in this version - it was introduced 4+ years later in Tomcat 9.0.40 (October 2020). Tomcat 7.0.70 only has ErrorReportValve, which outputs HTML error pages, not JSON. The attack chain requires JSON output to reach the Goal (manipulated JSON), but no JSON error reporting capability exists in this version.", "justification": "code_not_present" } }, { "id": "CVE-2023-24998", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:00817809-f94c-51cd-acfc-3533e3fc7bd4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-24998 is fixed in version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2023-28708", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:7d88306f-100a-57f8-9edd-2fbffcefa652", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-28708 is fixed in version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2023-41080", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:bf8c8019-f8e2-501b-acbd-a1420db200f9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-41080 is fixed in version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2023-42794", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:4a66fded-959c-5946-9e89-414edb3a1f1f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-42794 does not affect version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ha. not_affected \u2014 Tomcat 7.0.70 is NOT affected by CVE-2023-42794. The vulnerability exists in Tomcat 9.0.70-9.0.80 and 8.5.85-8.5.93 where an in-progress refactoring completely removed the finalize() method, preventing temporary file cleanup during garbage collection. Version 7.0.70 retains a functional finalize() method (lines 552-559 of DiskFileItem.java) that successfully deletes temporary files when objects...", "justification": "code_not_reachable" } }, { "id": "CVE-2023-42795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:cb9ae819-eb30-5ac2-87b4-dc922a82441e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-42795 affects version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2023-44487", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:fb90a42c-4e52-51b2-8f71-faec27bdffef", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-44487 affects version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2023-45648", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:cd00175b-34ef-59f6-a549-f6c6d247916a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-45648 affects version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2023-46589", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:a4056bda-c492-5bd2-92d2-4823d09ec330", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-46589 affects version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2024-21733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:1a2a2a9c-68d8-5efc-8598-b30c6e65eb9f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-21733 affects version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2024-24549", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:d8f08a78-1da0-5f1e-85f5-5e2addd3a95e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-24549 does not affect version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ha. Tomcat 7.0.70 is not affected by CVE-2024-24549. This vulnerability is specific to HTTP/2 header processing in Apache Tomcat, where streams were not reset until after all headers (including CONTINUATION frames) were processed when limits were exceeded. HTTP/2 support was introduced in Tomcat 8.5.0, and version 7.0.70 predates this feature entirely. The target codebase contains only HTTP/1.1 and AJP protocol implementations, which already enforce header size limits incrementally during parsing, not after completion.", "justification": "code_not_present" } }, { "id": "CVE-2024-34750", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:5c5a6014-11f1-503e-9f29-96a2c9c42df9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-34750 affects version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2024-38286", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:6c09de18-597f-5134-a3bb-5609291c2357", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38286 affects version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2024-50379", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:f1139509-a8ff-5740-aa86-ed7fd01e47ec", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-50379 affects version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2024-52316", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:61251494-f6bd-5153-972d-0c320dc96008", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-52316 does not affect version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ha. Tomcat 7.0.70 is not affected by CVE-2024-52316. This vulnerability specifically affects Jakarta Authentication (JASPIC) ServerAuthContext exception handling, but JASPIC support does not exist in Tomcat 7.x. JASPIC was introduced in Tomcat 8.5.x, and the target version (7.0.70) predates this feature entirely. The vulnerable code pattern (authenticateJaspic method catching AuthException without setting HTTP status) cannot exist in this version.", "justification": "code_not_present" } }, { "id": "CVE-2024-56337", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:4857a9f5-84b6-5f70-861e-3338f521140b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-56337 affects version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2025-24813", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:3da909fe-d1be-5b39-8c56-b7ee1f66a2de", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-24813 is fixed in version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2025-31650", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:6c85c65d-02ac-57f0-ab7c-9af76e781c11", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-31650 does not affect version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ha. Apache Tomcat 7.0.70 is NOT affected by CVE-2025-31650. This vulnerability targets HTTP/2 priority header parsing code that does not exist in Tomcat 7.0.x. HTTP/2 support was added in Tomcat 8.5+. The target lacks all HTTP/2 infrastructure (no http2 package, no Priority parsing, no HTTP/2 upgrade handlers), so the vulnerable INPUT type (invalid HTTP/2 priority headers/frames) is never received by the target codebase.", "justification": "code_not_present" } }, { "id": "CVE-2025-31651", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:25681ffb-998d-5ef7-b9dc-fbd6f12a2e18", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-31651 does not affect version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ha. Tomcat 7.0.70 does not contain the RewriteValve component where CVE-2025-31651 exists. The vulnerability requires RewriteValve to process rewrite rules with literal special characters ('%', ';', '?'). Without this component, the attack vector cannot exist. Exhaustive search confirms no RewriteValve.java, no rewrite directory under valves, and no URL rewriting functionality. RewriteValve was introduced in Tomcat 8.5+ series (CVE affects 8.5.0-8.5.100, 9.0.0-9.0.102, 10.1.0-10.1.39, 11.0.0-11.0.5).", "justification": "code_not_present" } }, { "id": "CVE-2025-46701", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:b724db14-0ed4-5bb2-b833-1df25c3cb5c4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-46701 affects version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2025-48988", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:a97f1883-1060-5f80-aab2-d5d4fe770f44", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-48988 affects version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2025-48989", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:252f7340-02c1-5b8b-b5b4-9c54a8fabe91", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-48989 affects version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2025-49124", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:736be1ce-a0a8-513d-982b-0e97cff75069", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49124 affects version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2025-49125", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:52313996-c00c-56f2-8b88-a5bf7b7576af", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-49125 does not affect version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ha. Tomcat 7.0.70 is not affected by CVE-2025-49125. The vulnerability concerns the org.apache.catalina.webresources package (PreResources/PostResources features with insufficient path validation using startsWith without boundary checks), which was introduced in Tomcat 8.0 and does not exist in Tomcat 7.x. Tomcat 7 uses the org.apache.naming.resources DirContext architecture for resource management. While Tomcat 7 has analogous path-based resource mounting features (aliases in BaseDirContext and extraResourcePaths in VirtualDirContext), both implementations include proper boundary checks that prevent the vulnerability pattern described in the CVE.", "justification": "code_not_present" } }, { "id": "CVE-2025-52434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:4ec6bbdc-1c18-5acf-8adb-552b9424037b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-52434 affects version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2025-52520", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:b47c2ba1-4aa4-52be-9bf1-f6939e6eb6b0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-52520 is fixed in version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2025-53506", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:0bf126b8-6548-5201-9f58-1369d9743a47", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-53506 affects version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2025-55668", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:027b17f9-4d94-56a3-b1d8-c9ebd2a3aa83", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-55668 does not affect version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ha. not_affected \u2014 Tomcat 7.0.70 is not affected by CVE-2025-55668. The vulnerability exists in the RewriteValve component (org.apache.catalina.valves.rewrite.RewriteValve), which was introduced in Tomcat 8.0 and does not exist in Tomcat 7.x. Exhaustive repository search confirms no RewriteValve code is present. TuxCare's backport history corroborates this finding - CVE-2025-55668 has been backported to Tomcat 8....", "justification": "code_not_present" } }, { "id": "CVE-2025-55752", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:5b3703b9-7527-5e4a-958b-edfa2a4d2512", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55752 affects version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2025-55754", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:ca5b9115-176d-537a-b238-65b0f1db00d4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55754 affects version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2025-61795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:7ea5517b-0f2a-50df-9bf0-5225fec4bd49", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-61795 affects version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2025-66614", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:00b68d57-d80a-5b44-9674-48b5055f39cc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-66614 does not affect version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ha. Tomcat 7.0.70 is not affected by CVE-2025-66614. The vulnerability requires SNI (Server Name Indication) support to extract the TLS SNI hostname and SSLHostConfig-based per-virtual-host TLS configurations to enable different client certificate authentication requirements per virtual host. Tomcat 7.0.70 does not support SNI - this feature was introduced in Tomcat 8.5 (confirmed by the target's own documentation in ssl-howto.xml). The CVE explicitly states \"Older EOL versions are not affected\", and version 7.0.70 predates the 8.5.0 threshold. Code analysis confirms no SNI extraction code, no SSLHostConfig class, and no Java SNI APIs are present in 7.0.70.", "justification": "code_not_present" } }, { "id": "CVE-2026-24733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:ee7294f0-6adc-5d59-b8d3-8232c7b3ed6c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24733 affects version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2026-24734", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:a0e9cef0-140c-5d4c-a02a-34517ba07877", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24734 affects version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2026-24880", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:3e0ecfac-7992-567b-a126-6b5dc468c5fb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24880 affects version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2026-25854", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:26fc96a3-de19-57b7-a3dd-ce8a9289452f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-25854 does not affect version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ha. not_affected \u2014 Apache Tomcat 7.0.70 is not affected by CVE-2026-25854. The vulnerable component LoadBalancerDrainingValve does not exist in this version - it was introduced in Tomcat 8.5.30. The CVE's affected version range (8.5.30+, 9.0.0.M23+, 10.1.0-M1+, 11.0.0-M1+) correctly excludes all Tomcat 7.0.x versions. Exhaustive search of the codebase confirmed no alternative implementation of the vulnerable func...", "justification": "code_not_present" } }, { "id": "CVE-2026-29146", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:a2091e8b-bf45-50e3-8118-8b4183d488b7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-29146 does not affect version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ha. Apache Tomcat 7.0.70 is not affected by CVE-2026-29146. The vulnerable EncryptInterceptor class does not exist in this version - it was introduced in Tomcat 7.0.100 or later. The CVE correctly identifies the affected version range starting at 7.0.100 for Tomcat 7.x. Target version 7.0.70 predates the vulnerable component.", "justification": "code_not_present" } }, { "id": "CVE-2026-34483", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:ad7c2336-8f00-587f-914f-0eb2faf69a8f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34483 affects version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2026-34487", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:bd1571ab-f76f-5b01-b025-f1d729a4ad16", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34487 affects version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2026-41284", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:ac049964-9cde-548e-9528-95a73a901868", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41284 affects version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2026-41293", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:a0d26577-e362-5a5f-ba04-1c89d4befdce", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41293 does not affect version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ha. Tomcat 7.0.70 is not affected by CVE-2026-41293. The vulnerability concerns improper character validation in HTTP/2 HPACK header decoding. Tomcat 7.0.70 does not include HTTP/2 protocol support - it only supports HTTP/1.1 and AJP. HTTP/2 support was introduced in Tomcat 8.5 and later versions. The vulnerable code (HPackHuffman, HpackDecoder, Http2Parser classes and associated validation methods) is entirely absent from this version. Exhaustive search confirmed no http2 package, no HTTP/2 Java files, and no HTTP/2 protocol handlers exist in the codebase.", "justification": "code_not_present" } }, { "id": "CVE-2026-42498", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:6829a0e9-4aac-5bc8-b4e7-7eb5a7042233", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-42498 does not affect version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ha. Apache Tomcat 7.0.70 is not affected by CVE-2026-42498. The vulnerability concerns exposure of HTTP authentication headers to unintended hosts during WebSocket client authentication. This version predates the introduction of WebSocket client authentication functionality, which was added between versions 7.0.82 and 7.0.83. The target lacks all authentication-related classes (Authenticator, BasicAuthenticator, DigestAuthenticator), authentication constants, and HTTP 401/407 response handling. Without the authentication feature, there are no authentication headers to expose.", "justification": "code_not_present" } }, { "id": "CVE-2026-43512", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:25ae81c6-97d0-575f-aba0-a81b3beed665", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43512 affects version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2026-43513", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:bce13e52-e8cc-5757-9d34-24147b829101", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43513 affects version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2026-43514", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:aef4d65b-7f52-5130-bb69-93f6f72f45b8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43514 affects version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2026-43515", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:7ba57f82-69cf-55d3-82b7-262648718d9c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43515 affects version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2026-53434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:e33ae1de-fd76-54bd-b9d8-d1f78bfbfe98", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53434 affects version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2026-65182", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:66722fe9-3eed-5eb7-bf93-e525891976ef", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65182 affects version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2026-65905", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:fe2ca502-d890-5c2d-94ea-77f1777b87d0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65905 affects version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2026-68525", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@7.0.70-tuxcare.4" } ], "bom-ref": "urn:uuid:8342eda8-17ea-570e-a3a4-e05fe5a3a517", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-68525 affects version 7.0.70-tuxcare.4 of org.apache.tomcat:tomcat-catalina-ha." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@7.0.70-tuxcare.4" } ] }