{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:93f81002-ef1d-5eb0-9d14-e7b6f7f4a15c", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat-coyote-ffm", "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote-ffm@10.1.50-tuxcare.2", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-coyote-ffm@10.1.50-tuxcare.2", "version": "10.1.50-tuxcare.2", "pedigree": { "ancestors": [ { "name": "tomcat-coyote-ffm", "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote-ffm@10.1.50", "type": "library", "group": "org.apache.tomcat", "version": "10.1.50" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2019-0199", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote-ffm@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:6665c49f-f3da-57f8-a97d-9d61650278a4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-0199 affects version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-coyote-ffm." } }, { "id": "CVE-2020-13934", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote-ffm@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:3827a615-186b-5965-b637-4809ea7391a1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-13934 affects version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-coyote-ffm." } }, { "id": "CVE-2020-13943", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote-ffm@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:86600ebc-dba2-56d0-984c-62721dfe54a6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-13943 affects version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-coyote-ffm." } }, { "id": "CVE-2020-17527", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote-ffm@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:c6337d56-75d1-5e64-9de7-e4436e07f113", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-17527 affects version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-coyote-ffm." } }, { "id": "CVE-2022-42252", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote-ffm@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:485c071b-905e-5ea9-848d-7361294ed51a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-42252 affects version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-coyote-ffm." } }, { "id": "CVE-2022-45143", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote-ffm@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:516b929a-b117-5a4b-9640-7ec2d9c9eeaa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-45143 affects version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-coyote-ffm." } }, { "id": "CVE-2023-24998", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote-ffm@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:67acd7a2-a291-5107-a292-aa1b9174de87", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-24998 affects version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-coyote-ffm." } }, { "id": "CVE-2023-42794", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote-ffm@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:aa81b280-b487-521b-afb2-39fc24ac0f59", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-42794 affects version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-coyote-ffm." } }, { "id": "CVE-2023-42795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote-ffm@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:f8c3492f-e83c-571b-98cb-927d7fca9edd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-42795 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-coyote-ffm. not_affected \u2014 CVE-2023-42795 is NOT present in Tomcat 10.1.50. The upstream fix (commit 9375d67106f by Mark Thomas on 2023-10-05) was already included in the upstream release before TuxCare onboarded version 10.1.50. All four affected recycle() methods (Request.java, ApplicationHttpRequest.java, B2CConverter.java, C2BConverter.java) contain the protective try-catch blocks that prevent exceptions from abortin...", "justification": "code_not_present" } }, { "id": "CVE-2023-44487", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote-ffm@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:9e261112-3c63-5808-9be2-d8a3a97df29d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-44487 affects version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-coyote-ffm." } }, { "id": "CVE-2023-45648", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote-ffm@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:7b0fb4c5-8379-576d-b94b-0468daed54b7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-45648 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-coyote-ffm. not_affected \u2014 Target version 10.1.50 is NOT AFFECTED by CVE-2023-45648. The upstream Apache Tomcat 10.1.50 release already contained the fix for improper HTTP trailer header validation. The vulnerability (unvalidated trailer headers enabling request smuggling) is not present because the code includes HttpHeaderParser with proper validation that rejects non-token characters in header names and control charact...", "justification": "code_not_present" } }, { "id": "CVE-2023-46589", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote-ffm@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:d7783df3-1dc2-5ce2-b6ea-8a2d9e042a38", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-46589 affects version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-coyote-ffm." } }, { "id": "CVE-2024-21733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote-ffm@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:bcd06223-56ff-58ac-a584-99762f698ac5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-21733 affects version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-coyote-ffm." } }, { "id": "CVE-2024-24549", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote-ffm@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:c3727615-0055-533b-8b77-08569a4514db", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-24549 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-coyote-ffm. Apache Tomcat 10.1.50 is not affected by CVE-2024-24549. The vulnerability affects versions up to 10.1.18, and was fixed by Apache in version 10.1.19. The target version 10.1.50 was onboarded with the upstream vendor fix already present. The fix moves HTTP/2 header validation from the end of header processing to the end of each frame (HEADERS and CONTINUATION), preventing resource exhaustion from processing excessive headers.", "justification": "code_not_present" } }, { "id": "CVE-2024-34750", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote-ffm@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:3347db24-7645-550d-8310-5a2db7531567", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-34750 affects version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-coyote-ffm." } }, { "id": "CVE-2024-38286", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote-ffm@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:25e3ff52-71b2-5f5a-a39c-43daa3d3908c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38286 affects version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-coyote-ffm." } }, { "id": "CVE-2025-31650", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote-ffm@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:fed8c174-00b1-5596-8b67-a91877bd5fb5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31650 affects version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-coyote-ffm." } }, { "id": "CVE-2025-48989", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote-ffm@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:87bfb5ba-862a-5f57-a2d6-35da0c0b811b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-48989 affects version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-coyote-ffm." } }, { "id": "CVE-2025-52434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote-ffm@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:4e4a188b-db42-5822-9790-5d9adfca9412", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-52434 affects version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-coyote-ffm." } }, { "id": "CVE-2025-53506", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote-ffm@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:ea0413a9-5602-5b5d-93ef-142ae0917c3f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-53506 affects version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-coyote-ffm." } }, { "id": "CVE-2025-66614", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote-ffm@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:f1c5d7cb-1229-570a-9c1b-f5e5015696d1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66614 affects version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-coyote-ffm." } }, { "id": "CVE-2026-24733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote-ffm@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:e2623ab4-fd9d-596c-87fa-5ec692e4cde6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-24733 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-coyote-ffm. not_affected \u2014 Apache Tomcat 10.1.50 is NOT affected by CVE-2026-24733. The vulnerability (accepting non-GET HTTP methods for HTTP/0.9 requests) is not present in the target. The upstream fix authored by remm@apache.org (commit 711b465cf2) was already included in the Apache Tomcat 10.1.50 release that TuxCare onboarded. The defense validates that HTTP/0.9 requests use only the GET method and rejects all other...", "justification": "code_not_present" } }, { "id": "CVE-2026-24734", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote-ffm@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:75dd30ff-89d2-59e3-aae5-4394ed35e827", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24734 affects version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-coyote-ffm." } }, { "id": "CVE-2026-24880", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote-ffm@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:d12511ad-8b10-541f-b7c8-a6f386f4c53d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-24880 is fixed in version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-coyote-ffm." } }, { "id": "CVE-2026-29145", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote-ffm@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:e698987e-d240-55a5-9555-7c3ea2c32dcc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29145 is fixed in version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-coyote-ffm." } }, { "id": "CVE-2026-32990", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote-ffm@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:5d59197f-66aa-5c85-8f3e-49f14c3f2acd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32990 is fixed in version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-coyote-ffm." } }, { "id": "CVE-2026-34500", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote-ffm@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:af9d06be-7986-5b61-ac65-e1a451c399c6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34500 affects version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-coyote-ffm." } }, { "id": "CVE-2026-41293", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote-ffm@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:eee40d82-a79a-53af-9f29-b23a9b412da0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41293 is fixed in version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-coyote-ffm." } }, { "id": "CVE-2026-53434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote-ffm@10.1.50-tuxcare.2" } ], "bom-ref": "urn:uuid:dbd838c1-6185-5505-9a36-bd4830dd2d56", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53434 affects version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-coyote-ffm." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote-ffm@10.1.50-tuxcare.2" } ] }