{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:e4cac366-fcfa-5ec6-afad-cea920fc1844", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat-catalina-ha", "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@9.0.24-tuxcare.1", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@9.0.24-tuxcare.1", "version": "9.0.24-tuxcare.1", "pedigree": { "ancestors": [ { "name": "tomcat-catalina-ha", "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@9.0.24", "type": "library", "group": "org.apache.tomcat", "version": "9.0.24" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2017-12617", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:8cdd81fa-30d8-5925-8cee-0752bd5abed0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-12617 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2017-5648", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:ebf34d96-4f3b-5a65-a74f-11b8b0792ce7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-5648 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2019-0199", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:14ca507b-9942-5b7b-ba70-821a335c08b4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-0199 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2019-0221", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:5d8c77fb-c476-5ea6-bb59-5999cd7c071d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-0221 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2020-13934", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:e7934b96-8d1d-55fc-95a8-32822e564fcb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-13934 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2020-13943", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:96a60fa3-96c4-59b4-8f53-d3e3438ee0d4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-13943 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2020-17527", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:b4c2ef51-3319-5249-9117-a7455222cf69", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-17527 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2020-9484", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:215aacad-bb29-5913-9aec-24e79d495b18", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-9484 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2022-42252", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:afb07cbd-feff-5dbc-95f7-c5868436efb3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-42252 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2022-45143", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:0ab249df-eee7-5c03-a433-7229cc95299b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-45143 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha. Apache Tomcat 9.0.24 is not affected by CVE-2022-45143. The vulnerability concerns JsonErrorReportValve, a component that does not exist in version 9.0.24. JsonErrorReportValve was introduced in Tomcat 9.0.40. Version 9.0.24 only contains ErrorReportValve, which produces HTML error pages and properly escapes user-controlled data using Escape.htmlElementContent(). The CVE's stated affected range (9.0.40 to 9.0.68) accurately reflects when the vulnerable component was introduced.", "justification": "code_not_present" } }, { "id": "CVE-2023-24998", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:4d2a456c-9193-5ba9-b75e-cd2ff037fd6b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-24998 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2023-28708", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:e8b41e2d-a1e3-5bb7-a832-45e915193893", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-28708 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2023-41080", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:0967af92-aae5-5d38-b58d-f4dab51f2bd5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-41080 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2023-42794", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:ce2d5dcd-e66e-5573-a630-b5d2e073b420", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-42794 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha. not_affected \u2014 Target version 9.0.24 is NOT AFFECTED by CVE-2023-42794. The vulnerability was introduced in versions 9.0.70-9.0.80 when an \"in progress refactoring\" removed the finalize() cleanup method from DiskFileItem.java. Version 9.0.24 predates this refactoring and still contains the original finalize() method (lines 549-558) that prevents temporary uploaded files from persisting indefinitely. The CVE a...", "justification": "code_not_present" } }, { "id": "CVE-2023-42795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:f9f34fde-6b21-552b-8aa9-6b5284271944", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-42795 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2023-44487", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:7d8e6558-4c3c-5344-aacf-7dfa32724dd8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-44487 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2023-45648", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:e17d2e60-f084-5ad1-8d11-e31867b0c688", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-45648 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2023-46589", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:89e93e5e-f085-50c8-89d4-3d8ae99a5f07", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-46589 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2024-21733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:e33b244d-e93a-5cbc-9404-4d785b239da0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-21733 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2024-24549", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:bb843196-3a04-5780-a9dd-1eaf47e60616", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-24549 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2024-34750", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:2b83ea73-05bd-5720-846c-5bc498f93279", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-34750 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2024-38286", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:ec9e3257-f2d0-518f-8701-cd4354d6816a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38286 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2024-50379", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:af351267-626a-59e6-89e4-7231ec2a68da", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-50379 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2024-52316", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:2e97154d-29cb-54c6-bf87-11b9c71093ea", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-52316 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2024-56337", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:be3ff3ec-9c2c-5fe1-8fad-04e85c07797e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-56337 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2025-24813", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:068c96a0-e60d-59b4-ae70-f8e3fc54016c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-24813 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2025-31650", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:908025a0-59ab-561a-bb87-c789f80cdacc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-31650 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha. Apache Tomcat 9.0.24 is not affected by CVE-2025-31650. The vulnerability affects HTTP/2 extensible priorities (RFC 9218) support, which was not implemented in this version. The target lacks all vulnerable code paths: PRIORITY_UPDATE frame handling, Priority.parsePriority() method, and priority HTTP header processing. The CVE's affected version range starts at 9.0.76, consistent with RFC 9218 support being added after 9.0.24.", "justification": "code_not_present" } }, { "id": "CVE-2025-31651", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:5b54db16-df8f-5dea-8021-2d5b3086a1b1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31651 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2025-46701", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:b3b59796-34ad-565c-8898-6f53230fe427", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-46701 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2025-48988", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:374c3e60-e9a3-530e-968f-d8d0106e0ebd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48988 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2025-48989", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:543412f6-b2e8-55d7-8a09-1a4c8b704782", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48989 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2025-49124", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:cd695e9a-62cb-5a07-9718-c8f43938b513", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-49124 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2025-49125", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:a2b56c5c-8c56-53ad-9e14-d203657b56a6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-49125 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2025-52434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:35f39459-f57c-5894-851c-db46de957445", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-52434 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2025-52520", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:9960cd5e-6a42-5340-b668-60e30e58ce38", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-52520 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2025-53506", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:aed66191-b8f4-5bac-83bb-90868805c32f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-53506 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2025-55668", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:79cd7d55-8a81-53fe-a99e-f66e9fdb2989", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-55668 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2025-55752", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:226a1a8c-4b83-5e71-8568-a65d005d1e1b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-55752 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2025-55754", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:c26e23c5-24f8-53a4-b390-665abf2ff869", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55754 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2025-61795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:efeca051-6e9e-5c05-98cc-8b0a35859b29", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-61795 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2025-66614", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:dfcd0f2b-b5ea-537f-b824-23b8bb0f60f1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66614 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2026-24733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:3e3de3f9-3434-5726-aaca-fcc9f372f458", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-24733 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2026-24734", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:4711e65a-390f-5d1e-8425-42147d67d13e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24734 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2026-24880", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:628b05ec-f7f0-5110-abf2-51390b75c7fb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24880 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2026-25854", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:fc66d2e4-ddec-554f-9b9a-a2d153ae452f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25854 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2026-29146", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:6d23a1fd-e674-516f-88db-6f5a91716cd6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29146 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2026-34483", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:65c87f26-4814-552c-b09a-4dc65cf7bff6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34483 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2026-34487", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:69460d7c-622d-5b35-952a-1699db238e4b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34487 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2026-41284", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:5e13a64a-5683-56b9-9c52-f33cc046dcb0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41284 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2026-41293", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:e9dd0230-744a-5c64-9c55-7d3a5b8dccd1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41293 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2026-42498", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:b686cf02-e05f-5591-bfb4-988552ce5683", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42498 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2026-43512", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:ad494049-119a-5b2f-801c-4e0cc68f01d6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43512 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2026-43513", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:dbb97f93-8f29-52e8-b5e2-9957c1c0c5e7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43513 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2026-43514", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:c33fd5b1-54c5-55cf-b95c-cc61c9450c3e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43514 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2026-43515", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:b2b97506-08e3-5a08-834b-1080cb3c712e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43515 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2026-53434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:f7dcba40-cbc9-55f1-ab25-12a1a1476ab9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53434 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2026-65182", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:e893d709-de14-5463-a159-41058d4c73b1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65182 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2026-65905", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:a931e3b8-8cfb-5142-b967-397480035bbf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65905 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } }, { "id": "CVE-2026-68525", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:c5c77ff6-04ef-596c-bd65-058d6f444e91", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-68525 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina-ha." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ha@9.0.24-tuxcare.1" } ] }