{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:32734ec5-d874-51c2-a37e-cc007fa73b41", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat-coyote", "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1", "version": "10.1.16-tuxcare.1", "pedigree": { "ancestors": [ { "name": "tomcat-coyote", "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16", "type": "library", "group": "org.apache.tomcat", "version": "10.1.16" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-0095", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:8c3415b7-daa0-5965-812d-b9d541993f64", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0095 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2016-6816", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:5b4f888e-c2ef-5303-9ae5-93c7f06ee19a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-6816 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2017-5651", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:52ad5f0e-36fd-5194-a783-daadf069bce9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-5651 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2019-0199", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:0b8bdf62-7301-5d1f-b4d8-c21bb2986c5d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-0199 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2020-13934", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:367ec0fc-fe15-550d-99a7-585089066558", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-13934 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2020-13943", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:d36f27d3-a964-5014-b30e-285f60539e92", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-13943 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2020-17527", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:767ed506-2dbc-5358-82cc-baf7dec0e95a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-17527 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2021-25122", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:51f34009-f7f0-54d2-bb96-8dd7511ca1b4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-25122 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2022-42252", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:39beb278-cc4f-5582-802c-7839382823ba", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-42252 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2022-45143", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:829327db-9268-5a60-9da2-bc57b8aec1af", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-45143 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-24998", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:c2aa7673-df43-540d-8485-e960eb4e0833", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-24998 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-28709", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:79d80661-230a-5d1a-9da8-2fa3b5e01f7d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-28709 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-34981", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:3995fc42-06c3-5b54-a89e-1fbc594d682d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-34981 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-42794", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:2093a504-4c3f-54e5-9d82-46184237b947", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-42794 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-42795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:348821d3-dc5b-5eb1-a873-ce5e7c3173d3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-42795 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 Apache Tomcat 10.1.16 is not affected by CVE-2023-42795. The vulnerability affects versions 10.1.0-M1 through 10.1.13, and was fixed in 10.1.14 and later. Since 10.1.16 > 10.1.14, the fix was already present in the upstream release when TuxCare onboarded it. All five recycle() method fixes (exception handling in Request.part.delete(), ApplicationHttpRequest.session.endAccess(), B2CConverter.dec...", "justification": "code_not_present" } }, { "id": "CVE-2023-44487", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:c685312a-5aa5-58fc-92e4-80ef9f1a39a6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-44487 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-45648", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:2a19f498-2ecb-5a7a-9ade-761feba2a0a4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-45648 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 The target Tomcat 10.1.16 is NOT AFFECTED by CVE-2023-45648. The vulnerability involves improper validation of HTTP trailer headers that could enable request smuggling. The upstream fix (commit 8ecff306507be8e4fd3adee1ae5de1ea6661a8f4 by Mark Thomas) was already present in the Tomcat 10.1.16 release that TuxCare onboarded. Both ChunkedInputFilter.java and Http11InputBuffer.java contain the requ...", "justification": "code_not_present" } }, { "id": "CVE-2023-46589", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:9bf00f72-56bc-566d-be25-f73b2f86d88c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-46589 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-21733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:d6f3f9d1-0b3a-55d4-95a6-af44ba82080f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-21733 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-24549", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:7abd38d0-ccdb-52ea-99af-e0c347fd3d28", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-24549 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-34750", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:0e62153c-4810-5df7-af04-5a44e0e0feb3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34750 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-38286", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:690836fe-94ea-5b6c-8327-babde83cd06e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38286 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-52317", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:fb89d738-b842-518e-994c-08cb57d4fa55", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-52317 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2025-31650", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:77059ded-bbd8-5e72-b9c7-e2fabe3a4f58", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31650 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2025-48989", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:bcaefff3-4311-5734-914f-02818682b20d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48989 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2025-52434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:3164c6d3-6143-5230-9a9a-ced7370ce79b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-52434 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2025-53506", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:ce1fc3d9-fc50-503c-b539-da0bdd8b8fdf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-53506 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2025-66614", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:47444ae8-8aa0-5751-aca0-7a5843353c56", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66614 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-24733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:ebf0a1b0-5280-5f53-8f12-3c6de4e6039e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24733 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-24734", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:ad182c19-93b7-5be1-861b-15c53ced05d1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24734 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-24880", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:a6264111-6e9a-59aa-bbb0-ed3276d45c4a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24880 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-29129", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:b5a82994-d7b1-51df-bc37-e25480162f3f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-29129 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-32990", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:fd5cb131-ffd3-5fca-84e3-cd28e43a41f6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-32990 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 Apache Tomcat 10.1.16 is not affected by CVE-2026-32990. The vulnerability exists in the checkSni() method's incomplete fix for CVE-2025-66614, affecting versions 10.1.50-10.1.52. Version 10.1.16 predates the introduction of the strict SNI validation feature entirely - the checkSni method, strictSni field, and protocolHostName parameter do not exist in this version. The vulnerability pattern (c...", "justification": "code_not_present" } }, { "id": "CVE-2026-41293", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:851d2f2c-0540-5195-ba3b-febb01980c08", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41293 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-53434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:0d825f04-dbad-51cf-bbc5-93e584d48dbb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53434 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-65637", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:ba05e2f3-1cdf-5486-a003-9098f2d6c19f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65637 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.16-tuxcare.1" } ] }