{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:eab288ed-5320-5fd6-b989-76c841886c48", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat-catalina-ws", "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@8.5.78-tuxcare.2", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@8.5.78-tuxcare.2", "version": "8.5.78-tuxcare.2", "pedigree": { "ancestors": [ { "name": "tomcat-catalina-ws", "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@8.5.78", "type": "library", "group": "org.apache.tomcat", "version": "8.5.78" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2017-12617", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:3af947f7-d325-59f6-9bcd-e19ae6b18c9d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-12617 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-catalina-ws. The target (Apache Tomcat 8.5.78) is not affected by CVE-2017-12617. The vulnerability allowed uploading JSP files via HTTP PUT with specially crafted paths ending in '/' to bypass security checks (the Java File API drops trailing slashes). The upstream Apache Tomcat project fixed this in commits 506d862e7e and 4cf7dab882 (authored by Mark Thomas, September 2017) by adding checks that reject file write operations when the path ends with '/'. These fixes were already present in Apache Tomcat release 8.5.78 before TuxCare onboarded it (first TuxCare commit: fb98844404 \"Onboard version 8.5.78\" by amoniatovskiy@cloudlinux.com). The defensive code is verified present at AbstractFileResourceSet.java:69 and DirResourceSet.java:252.", "justification": "code_not_present" } }, { "id": "CVE-2017-5648", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:d9528fca-7b0c-5829-849f-fb29106d8b93", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-5648 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-catalina-ws. Target Tomcat 8.5.78 is not affected by CVE-2017-5648. The vulnerability pattern (passing internal Request objects to application listeners without facade wrapping) is not present. All 7 call sites to fireRequestInitEvent() and fireRequestDestroyEvent() correctly use request.getRequest() to pass facade-wrapped objects. The fix was introduced by upstream commit 0f7b9465d5 (author: Mark Thomas, markt@apache.org) in March 2017 for Tomcat 8.5.12+, which was already present in the upstream 8.5.78 release when TuxCare onboarded it. CVE affects 8.5.0-8.5.11; target 8.5.78 is above this range.", "justification": "code_not_present" } }, { "id": "CVE-2019-0199", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:4b62ed65-fb90-517c-8a49-320f7f511331", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-0199 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-catalina-ws." } }, { "id": "CVE-2019-0221", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:f43660fb-efb2-5c52-ac97-4a169644f915", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-0221 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-catalina-ws." } }, { "id": "CVE-2020-13934", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:d086eb5f-bd1a-5b3c-b4bd-0a1d253a5a71", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-13934 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-catalina-ws. Target version 8.5.78 is not affected by CVE-2020-13934. The vulnerability (failure to release HTTP/1.1 processor after h2c upgrade leading to memory exhaustion) was fixed in upstream Apache Tomcat by commit 923d834500 authored by Mark Thomas (markt@apache.org). This fix was included in the upstream 8.5.78 release, which is newer than the last affected version (8.5.56). The target repository contains the complete fix: the HTTP/1.1 processor is properly released via `release(processor)` before creating the HTTP/2 upgrade processor, and the control flow correctly uses `state = SocketState.CLOSED` to trigger cleanup.", "justification": "code_not_present" } }, { "id": "CVE-2020-13943", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:3fa8e25b-f2e4-5798-9f68-5ceedff13974", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-13943 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-catalina-ws. not_affected \u2014 Apache Tomcat 8.5.78 is not affected by CVE-2020-13943. The upstream fix was already present in version 8.5.78 when TuxCare onboarded it. The CVE affects versions 8.5.0 to 8.5.57; this is 8.5.78. The vulnerability involved HTTP/2 header confusion when concurrent stream limits were exceeded due to checking limits during initial header parsing (headersStart) rather than after complete parsing (he...", "justification": "code_not_present" } }, { "id": "CVE-2020-17527", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:d1c01620-4c86-5479-b118-81624ecdaf01", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-17527 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-catalina-ws." } }, { "id": "CVE-2020-9484", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:59e155a0-2a13-5146-837f-54787368c1e0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-9484 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-catalina-ws. CVE-2020-9484 deserialization vulnerability is NOT present in Apache Tomcat 8.5.78. The fix was authored by Mark Thomas (Apache upstream) on May 5, 2020, and shipped in Apache Tomcat 8.5.55. Version 8.5.78 inherits this fix from upstream. The FileStore.java file at lines 355-358 implements path traversal validation that rejects session IDs attempting to escape the storage directory, preventing deserialization of attacker-controlled files. CVE affected versions: 8.5.0 to 8.5.54; target version 8.5.78 is after the fixed version.", "justification": "code_not_present" } }, { "id": "CVE-2021-25122", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:3126b28e-6d83-58fc-8b61-4a4ac5a45708", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-25122 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-catalina-ws." } }, { "id": "CVE-2022-42252", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:81b9ac2e-8788-5c9d-8f38-77fb52f0b6d9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-42252 is fixed in version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-catalina-ws." } }, { "id": "CVE-2022-45143", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:e1bbd967-5bac-5359-84de-e407a9692562", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-45143 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-catalina-ws. CVE-2022-45143 affects JsonErrorReportValve, which does not exist in Tomcat 8.5.78. The vulnerability involves missing JSON escaping in type/message/description fields. The target version only has ErrorReportValve, which generates HTML error reports with proper HTML escaping (Escape.htmlElementContent). JsonErrorReportValve was introduced upstream on 2020-10-14 in versions 8.5.83+, 9.0.40+, and 10.1.0+, never backported to 8.5.78. The attack chain (user-provided error data \u2192 manipulated JSON output) cannot complete because JSON error reporting does not exist in the target. Verdict: not_affected per Rule 5 Type A2 (input received but chain to Goal broken by missing JSON generation).", "justification": "code_not_reachable" } }, { "id": "CVE-2023-24998", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:e6823ab2-0a88-5752-81ca-0c8a5832e726", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-24998 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-catalina-ws." } }, { "id": "CVE-2023-28708", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:726666a5-4199-5ed5-a240-a82f8dc86e7a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-28708 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-catalina-ws, and is fixed in 8.5.78-tuxcare.3." } }, { "id": "CVE-2023-41080", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:ddc04325-6002-56a4-a519-98fa9017d828", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-41080 is fixed in version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-catalina-ws." } }, { "id": "CVE-2023-42794", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:b39687d0-7d57-5861-9d02-367942c73a35", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-42794 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-catalina-ws. not_affected \u2014 Apache Tomcat 8.5.78-tuxcare.3 is not affected by CVE-2023-42794. The vulnerability was introduced by a refactoring in version 8.5.85 that removed the finalize() cleanup method from DiskFileItem.java. Since the target version (8.5.78) predates this refactoring, it retains the original finalize() method (lines 538-548) that provides automatic cleanup of temporary uploaded files during garbage co...", "justification": "code_not_present" } }, { "id": "CVE-2023-42795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:3d33ccbe-5604-52da-a722-da98868e1e67", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-42795 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-catalina-ws." } }, { "id": "CVE-2023-44487", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:e66c17f4-5ec5-5466-9c61-1ab112a41188", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-44487 is fixed in version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-catalina-ws." } }, { "id": "CVE-2023-45648", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:bad1161a-240c-55cc-8d26-ef00fdbad998", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-45648 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-catalina-ws." } }, { "id": "CVE-2023-46589", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:0b301fed-46b9-5f90-b073-3b9d6085fba6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-46589 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-catalina-ws." } }, { "id": "CVE-2024-21733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:625bfc1d-a80d-5bd2-b4fd-144a14d8fe12", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-21733 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-catalina-ws." } }, { "id": "CVE-2024-24549", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:129abf78-024b-5cdb-b825-214dc76559e7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-24549 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-catalina-ws." } }, { "id": "CVE-2024-34750", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:9e4ef5a3-48ee-53cb-9e08-08e4d32c2ed0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-34750 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-catalina-ws." } }, { "id": "CVE-2024-38286", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:cb94a997-2a04-5a64-89ed-3422e068d881", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38286 is fixed in version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-catalina-ws." } }, { "id": "CVE-2024-50379", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:f49b3d01-a92c-52e2-a23b-95bc543684ba", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-50379 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-catalina-ws." } }, { "id": "CVE-2024-52316", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:4521defa-5795-50c2-96ec-4f89e1cf4b50", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-52316 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-catalina-ws." } }, { "id": "CVE-2024-56337", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:b635dfc7-df1c-5d90-957c-3b5ad6e6fa30", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-56337 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-catalina-ws." } }, { "id": "CVE-2025-24813", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:cc50a2c6-02d5-5aba-ae85-cc64d28b5ada", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-24813 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-catalina-ws." } }, { "id": "CVE-2025-31650", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:923ee29d-2fa0-5678-a02d-64cf60adadc4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-31650 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-catalina-ws. Apache Tomcat 8.5.78 is NOT AFFECTED by CVE-2025-31650. This vulnerability requires RFC 9218 HTTP Extensible Priorities support, which was not introduced until version 8.5.90. Version 8.5.78 lacks the Priority class, PRIORITY_UPDATE frame type, readPriorityUpdateFrame() method, and all priority header parsing code that contains the vulnerability. The CVE's affected version range (8.5.90-8.5.100) correctly excludes 8.5.78.", "justification": "code_not_present" } }, { "id": "CVE-2025-31651", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:82ffc27d-fab1-567e-ade3-112fe5066131", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31651 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-catalina-ws." } }, { "id": "CVE-2025-46701", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:9ffa83b1-6d87-5977-a9bb-aeb541cd7529", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-46701 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-catalina-ws." } }, { "id": "CVE-2025-48988", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:fa38c2cd-5ea8-5b84-b5c7-a61a7f396053", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-48988 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-catalina-ws." } }, { "id": "CVE-2025-48989", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:f62e0169-b6f6-5d0e-a394-576ecf385608", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-48989 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-catalina-ws." } }, { "id": "CVE-2025-49124", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:433e362b-47ef-5799-8238-609a557a9845", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49124 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-catalina-ws." } }, { "id": "CVE-2025-49125", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:9bac26b1-2922-5c03-b733-4d58cb7043e6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49125 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-catalina-ws." } }, { "id": "CVE-2025-52434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:0ec7a2a5-1956-57e4-aa20-f06c34712b1e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-52434 is fixed in version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-catalina-ws." } }, { "id": "CVE-2025-52520", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:b755e539-62dd-562a-b28d-b4fddb39ab5d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-52520 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-catalina-ws." } }, { "id": "CVE-2025-53506", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:98357ae7-17c2-56ba-91ea-dfb167d14cb1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-53506 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-catalina-ws." } }, { "id": "CVE-2025-55668", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:f9ae0f46-e878-5d7c-8dee-bc49b72746e4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55668 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-catalina-ws." } }, { "id": "CVE-2025-55752", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:c1a25dc1-e2ae-5e67-8851-5c5ca74c6b68", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-55752 is fixed in version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-catalina-ws." } }, { "id": "CVE-2025-55754", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:6f8efd6d-f5af-5fb4-a00c-eb91fbf55cbe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-55754 is fixed in version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-catalina-ws." } }, { "id": "CVE-2025-61795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:4996f7d6-4875-53ea-a27b-4166cf092697", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-61795 is fixed in version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-catalina-ws." } }, { "id": "CVE-2025-66614", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:62ac00c6-e6cc-5cc6-a19c-7af74c5ab679", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66614 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-catalina-ws." } }, { "id": "CVE-2026-24733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:146d606f-5275-55b7-872a-0fbf94579fad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-24733 is fixed in version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-catalina-ws." } }, { "id": "CVE-2026-24734", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:28ad1c5a-e603-53c0-a60d-220fa9d898a6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24734 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-catalina-ws." } }, { "id": "CVE-2026-24880", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:d501aca4-46ad-52cc-aa5e-03959e557ef0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-24880 is fixed in version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-catalina-ws." } }, { "id": "CVE-2026-25854", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:f98b53c4-e6e2-5dac-8be8-2befe370bc07", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25854 is fixed in version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-catalina-ws." } }, { "id": "CVE-2026-34483", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:5966a170-8894-53d7-96f5-b46018bf7cd2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34483 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-catalina-ws." } }, { "id": "CVE-2026-41284", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:1f65ca39-53b1-576d-992a-9ed927c9f3e2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41284 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-catalina-ws." } }, { "id": "CVE-2026-41293", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:b583138e-ecc9-519b-939a-6e92cfa07756", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41293 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-catalina-ws." } }, { "id": "CVE-2026-42498", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:f5610e70-042c-51ab-96cb-e1456fb9df32", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42498 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-catalina-ws." } }, { "id": "CVE-2026-43512", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:765bc184-3174-5c0a-be4a-2d2c0ee895e0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43512 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-catalina-ws." } }, { "id": "CVE-2026-43513", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:b273f590-668f-5ef0-aa41-a949d641e496", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43513 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-catalina-ws." } }, { "id": "CVE-2026-43514", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:d4a5705b-4c83-5fca-805c-5d99f52f092a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43514 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-catalina-ws." } }, { "id": "CVE-2026-43515", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:42795149-27db-53e1-9f1b-4681882b55c4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43515 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-catalina-ws." } }, { "id": "CVE-2026-53434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:2de19e8b-6023-5882-973d-0c5cd7fa2107", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53434 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-catalina-ws." } }, { "id": "CVE-2026-65182", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:f5638716-5f50-54f2-b760-003ad5d48ea5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65182 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-catalina-ws." } }, { "id": "CVE-2026-65905", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:01bb2770-332e-5585-9091-0911a61acffe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65905 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-catalina-ws." } }, { "id": "CVE-2026-68525", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:bdd84e84-710c-5d70-89fd-c5bd8a77e4fe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-68525 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-catalina-ws." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina-ws@8.5.78-tuxcare.2" } ] }