{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:80f49750-a8ef-5c8e-be48-7dbf96f1d43e", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat-coyote", "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.55-tuxcare.1", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.55-tuxcare.1", "version": "10.1.55-tuxcare.1", "pedigree": { "ancestors": [ { "name": "tomcat-coyote", "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.55", "type": "library", "group": "org.apache.tomcat", "version": "10.1.55" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-0095", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:5f79ecdc-f975-5cfe-b681-7a81e92ed4c0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0095 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2016-6816", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:cd745eed-325f-58a0-ab8a-d496a0fc04a9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-6816 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2017-5651", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:a2e00f12-7c9b-5f6d-a854-d3c8c7f3fc0f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-5651 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2019-0199", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:0244200c-6362-5ee4-b2df-cca1f690e46c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-0199 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2020-13934", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:a96cda6f-9d40-5760-8851-adba67e874f7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-13934 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2020-13943", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:81539d26-432d-54b2-928a-be4354cb05a0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-13943 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2020-17527", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:c16708c4-b21c-5de7-81f4-35affb6556ab", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-17527 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2021-25122", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:90410d3d-3e8c-5612-843c-6ad019e19d03", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-25122 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2022-42252", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:5946df0e-65c7-5f0a-9847-e2bd3c9b0028", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-42252 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2022-45143", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:e360f96c-07f9-55f9-937a-e955c37b3754", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-45143 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-24998", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:504052eb-2607-57ef-b0fb-2e9ef0c87fdb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-24998 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-28709", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:91843c3d-b9ec-525a-85f8-4b6d9fd7646a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-28709 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-34981", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:5e1bcbfe-4221-5659-96be-4f1ba63d5ac8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-34981 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-42794", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:4313e841-cd69-5e92-9bc5-e64dd44bdcba", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-42794 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-42795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:3ca07ecc-efdd-5ee2-a2a4-aebb57ca06a9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-42795 does not affect version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 CVE-2023-42795 (Incomplete Cleanup vulnerability) is not present in Tomcat 10.1.55. The upstream fix by Mark Thomas (commit 9375d67106) was included in the Apache Tomcat 10.1.55 release that TuxCare onboarded. All required defensive changes are present: try-catch blocks in recycle() methods for Request.java, ApplicationHttpRequest.java, B2CConverter.java, and C2BConverter.java ensure cleanup co...", "justification": "code_not_present" } }, { "id": "CVE-2023-44487", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:1e468968-d755-5db9-b4ae-076752264945", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-44487 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-45648", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:8639871c-ccf2-5fcc-b4bc-34a211bf406a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-45648 does not affect version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 CVE-2023-45648 is NOT present in Tomcat 10.1.55. The vulnerability (improper HTTP trailer header parsing allowing request smuggling) was fixed in the upstream release before TuxCare onboarded it. Tomcat 10.1.55 uses HttpHeaderParser class for trailer parsing, which includes built-in validation that rejects non-token characters in header names (line 141-148) and control characters except tab in ...", "justification": "code_not_present" } }, { "id": "CVE-2023-46589", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:da067a3a-77aa-5a34-8d1d-1ba68042b824", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-46589 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-21733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:9b6e17c2-4c4b-5e5a-a4d2-e589f8697cae", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-21733 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-24549", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:1b0ba202-702c-5d0d-9bf9-06cd99df101f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-24549 does not affect version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-coyote. The target Apache Tomcat 10.1.55 is NOT vulnerable to CVE-2024-24549. The vulnerability was fixed in upstream Tomcat 10.1.19 (released 2024-02-19), and version 10.1.55 includes this fix. The fix moves HTTP/2 header validation to occur after each frame (HEADERS and CONTINUATION) rather than delaying until all headers are complete, preventing resource exhaustion from oversized headers. The fix commit (d07c82194e by markt@apache.org) is present in the target's git history and was part of the upstream release onboarded by TuxCare.", "justification": "code_not_present" } }, { "id": "CVE-2024-34750", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:17123be3-7412-5f27-96f0-558f570516ec", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-34750 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-38286", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:3923cfff-b9f0-5fea-b1f3-12da2342e541", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38286 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-52317", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:34679a78-e473-5c8c-a7aa-e19418307b0f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-52317 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2025-31650", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:20a69009-1267-564e-a125-e57bf2065d41", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31650 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2025-48989", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:6f1f4d52-06db-558b-93f3-c320dbba73b9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-48989 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2025-52434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:32d75a1e-9910-567a-a410-c1b31546b66f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-52434 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2025-53506", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:16f22616-761d-5f5c-b831-b9d051ee6351", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-53506 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2025-66614", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:36aa23eb-3ced-5b15-a10b-0dcc0894c37d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66614 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-24733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:0e951fab-6656-59dc-98c2-95da4111cdd8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-24733 does not affect version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 Apache Tomcat 10.1.55 is not affected by CVE-2026-24733. The CVE describes a vulnerability where HTTP/0.9 requests were not limited to the GET method, allowing security constraint bypass. However, the fix was already present in upstream Apache Tomcat 10.1.55 (released after the fixed version 10.1.50). The defense code is present at Http11Processor.java:612-616, which rejects HTTP/0.9 requests w...", "justification": "code_not_present" } }, { "id": "CVE-2026-24734", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:410f0b04-74ec-5f3c-9fe3-a48e275c8a3f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24734 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-24880", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:59136489-1284-50b0-970d-6e88e56e814d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-24880 does not affect version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-coyote. CVE-2026-24880 (HTTP Request Smuggling via invalid chunk extension) is NOT present in Tomcat 10.1.55. The vulnerability required proper validation of chunk extension syntax to prevent inconsistent interpretation between HTTP processors. The upstream fix (commits f07df938d0 and 1e71441a15 by Mark Thomas) introduced a ChunkExtension.parse() state machine parser that validates chunk extensions according to RFC specifications. This fix was already included in the upstream Apache Tomcat 10.1.55 release, which TuxCare subsequently onboarded. The target code contains the complete fix: ChunkExtension.java with the state machine parser exists, and ChunkedInputFilter.java correctly uses ChunkExtension.parse() to validate all chunk extensions in both parseChunkHeader() and skipChunkHeader() methods.", "justification": "code_not_present" } }, { "id": "CVE-2026-29129", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:fc5ca759-ecd0-5044-8ba4-85553deb1c2a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-29129 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-32990", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:aaa7b45e-11a8-594f-ae6f-2ee206021e07", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-32990 does not affect version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 CVE-2026-32990 is NOT present in Apache Tomcat 10.1.55. The fix for this vulnerability (normalizing HTTP Host header to lowercase before SSL configuration lookup) was already included in the upstream Apache Tomcat 10.1.55 release. The target version 10.1.55 is newer than the CVE's affected range (10.1.50-10.1.52), and the fix commit by remm@apache.org is present in HEAD, predating all TuxCare o...", "justification": "code_not_present" } }, { "id": "CVE-2026-41293", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:ea98d03d-06a8-58ed-9555-52e75b6836fb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41293 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-53434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:2e970b47-09a2-5e37-9d76-50ae7a23ec96", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53434 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-65637", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:2137ba3b-156a-5365-8727-72007aee765c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65637 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@10.1.55-tuxcare.1" } ] }