{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:69dcc0b9-009c-5617-9834-828acc902037", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat-catalina", "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.16", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.16", "version": "9.0.50-tuxcare.16", "pedigree": { "ancestors": [ { "name": "tomcat-catalina", "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50", "type": "library", "group": "org.apache.tomcat", "version": "9.0.50" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-5388", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:fa2afe30-a14c-5d91-9783-5f75f6934249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5388 affects version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2016-8735", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:7f2c2316-b894-533f-81d3-e827eaa78664", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-8735 affects version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2017-12616", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:6cfd908c-984a-5c19-bef3-b2d15ce81a92", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-12616 affects version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2017-12617", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:5a9e82f9-337c-5c8f-a503-1132e0da5021", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-12617 affects version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2017-5648", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:073bdc48-b8c8-57e6-b960-cf6e7dc21ef8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-5648 affects version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2019-0199", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:5a1d0bab-8e79-5bcf-ae9f-13769964cb22", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-0199 affects version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2019-0221", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:30380c7e-bc96-500e-9581-edef5d306b61", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-0221 affects version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2020-13934", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:29ebe0c4-c677-51ac-90c2-4f7217ec66e6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-13934 does not affect version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-catalina. CVE-2020-13934 affects Apache Tomcat 9.0.0.M5-9.0.36", "justification": "code_not_present" } }, { "id": "CVE-2020-13943", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:12a1dcd4-2132-5190-aab3-3fc47ac41157", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-13943 does not affect version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-catalina. Version 9.0.50 is not vulnerable. Summary: Target repository already has the fix for CVE-2020-13943 applied. The maxConcurrentStreams check is correctly located in headersEnd() method, not in headersStart(). [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "code_not_present" } }, { "id": "CVE-2020-17527", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:e4ee16e6-4d6a-56f4-ab3c-61f940e6d498", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-17527 affects version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2020-9484", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:bf3efb67-7674-5425-82ae-7e81fe7e763c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-9484 does not affect version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-catalina. Fix already present in baseline since 9.0.35. Verified in java/org/apache/catalina/session/FileStore.java:303 \u2014 canonicalFile.toPath().startsWith(storageDir.getCanonicalFile().toPath()) containment check is in place. Advisory range 9.0.0.M1-9.0.34; 9.0.90 is well past the fix.", "justification": "code_not_present" } }, { "id": "CVE-2022-42252", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:f65416ee-de97-5099-bfff-aca9f004afe0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-42252 is fixed in version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2022-45143", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:06f599c3-e2bc-532a-b95a-31ac3481d956", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-45143 is fixed in version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2023-24998", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:cd9cd72c-ce77-5aea-95dd-188de3c72f31", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-24998 is fixed in version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2023-28708", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:ca15123a-5390-538f-bfaa-6d0d977006de", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-28708 is fixed in version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2023-41080", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:eaaaaef8-20b1-5be8-8f1c-8ca35152db58", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-41080 is fixed in version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2023-42794", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:02d09f9f-ce29-5b68-90c0-4968759889fc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-42794 does not affect version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-catalina. not_affected \u2014 Apache Tomcat 9.0.50 is NOT affected by CVE-2023-42794. The target version (released June 28, 2021) predates the vulnerable versions (9.0.70-9.0.80) and already contains the finalize() method that prevents the vulnerability. The CVE describes a denial-of-service issue introduced by \"unreleased, in progress refactoring\" that removed the finalize() cleanup method in versions 9.0.70-9.0.80. Versio...", "justification": "code_not_present" } }, { "id": "CVE-2023-42795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:e6add7ab-99ec-59cd-9fdb-120af3f3da28", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-42795 is fixed in version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2023-44487", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:2a41b2bb-7353-5b1d-b36c-379d68ba6b85", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-44487 is fixed in version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2023-45648", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:2e711ef1-b5eb-5718-abad-8fcfe701c827", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-45648 is fixed in version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2023-46589", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:483483f7-e207-5786-8c6f-7d758702eb09", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-46589 is fixed in version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2024-21733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:baa8ba5f-5636-5bc1-a171-cd4d925ce482", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-21733 affects version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2024-24549", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:85e7aebc-e593-5d99-8c4d-cb897690d30f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-24549 is fixed in version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2024-34750", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:5a117f85-e21c-5b91-a083-fb3c3ac9293d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34750 is fixed in version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2024-38286", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:8d1a1122-e685-5f87-8ff4-1927fc678ccf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38286 is fixed in version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2024-50379", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:6a869916-2481-500f-b3d3-14eeabf0ceb9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-50379 is fixed in version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2024-52316", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:816f91b7-b077-5c67-a30a-3aa52dbf3279", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-52316 is fixed in version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2024-56337", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:f3fc15ce-7b79-5668-98de-0de21a92c14a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-56337 is fixed in version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-24813", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:aec1dd7f-58a9-5f6a-ac16-4e72b9c0a6d1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-24813 is fixed in version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-31650", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:d05e413b-1513-5d05-967b-a17f2b732e4e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-31650 does not affect version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-catalina. 9.0.50 predates HTTP/2 RFC 9218 PRIORITY_UPDATE frame support (added in 9.0.76). Advisory range per NVD/Snyk/GHSA is 9.0.76-9.0.102. Code inspection confirms: Http2Parser.processFramePriorityUpdate method and priority parsing in Stream.emitHeader do not exist in this baseline. Vulnerable code path is absent.", "justification": "code_not_present" } }, { "id": "CVE-2025-31651", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:15fd7a82-a2d5-5adc-8a88-517e033b3023", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-31651 is fixed in version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-46701", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:beca26e6-b139-59ca-959a-dc02c7cb3183", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-46701 is fixed in version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-48988", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:bf777e18-d6e3-5516-a9bd-522d97b2df03", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48988 is fixed in version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-48989", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:0384d38d-3c4b-5e05-b1f2-ada160837c4c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48989 is fixed in version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-49124", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:49094fcb-b0e0-5850-9e76-b29857f06f4e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-49124 is fixed in version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-49125", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:ce0d9136-1beb-5ee6-ab9d-417762cc1036", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-49125 is fixed in version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-52434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:562e5d12-3b11-5e5d-ad0c-3cbc27ce20b4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-52434 is fixed in version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-52520", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:fa1f9ede-67d9-5094-a1af-be0b3d255058", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-52520 is fixed in version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-53506", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:93fd4d50-d36c-5254-b12c-383855f48505", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-53506 is fixed in version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-55668", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:eba45b05-06c8-578a-a752-3de2ee9f8613", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-55668 is fixed in version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-55752", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:5a724695-3a7c-5516-a648-5056f99a7182", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55752 affects version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-55754", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:3279d4b0-aab9-5d75-b797-a18894e5346f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-55754 is fixed in version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-61795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:f48dc328-3c37-50cb-88e2-a4ca2770d1a1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-61795 is fixed in version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-66614", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:b62cff0f-10d1-5410-9c46-8911ac8a5065", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66614 is fixed in version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-24733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:6a52222a-c4c9-5534-8982-9cd9b2c7b3ce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-24733 is fixed in version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-24734", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:7ff24f8e-8b17-5f8d-a70e-d19d5e0ab789", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24734 affects version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-24880", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:657574fb-f08c-5aa4-ada4-402c7b1b6555", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24880 affects version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-25854", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:9fe2920d-f734-58b3-9058-e2d0accbfdc3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25854 is fixed in version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-34483", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:fb71b4c4-4f10-5eb5-bf9b-0803bf747e08", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34483 is fixed in version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-41284", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:4432ab30-5314-54ea-a9a9-e9ab7e33b606", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41284 affects version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-41293", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:f07f034d-312d-5b7f-9f04-e87266c7a301", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41293 affects version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-42498", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:02a07270-494e-5b2e-bb06-1c10403d1c18", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42498 affects version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-43512", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:c6ba6c29-7a2c-551a-87ea-224db195a1d9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43512 affects version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-43513", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:6d4e4263-6a95-5cda-ae1c-d1a9f4bc561e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43513 affects version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-43514", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:5e205843-9070-5662-941f-64da5203daa3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43514 affects version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-43515", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:de458fe5-10ab-5d5a-8c41-6385678c88f3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43515 affects version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-53434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:0340aa4e-29bd-5ff5-a116-42cd5294246e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53434 affects version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-65182", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:5b9ae2c5-5c24-521e-8294-1191da4c4377", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65182 affects version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-65905", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:05b9f704-8088-571f-aeeb-7e8cfb0256af", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65905 affects version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-68525", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:ae011182-b05d-5396-b484-5b8c78a9c8c2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-68525 affects version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-catalina." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.16" } ] }