{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:04f5c197-6492-586d-85b2-def6d8e67747", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat-coyote", "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.5", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.5", "version": "7.0.109-tuxcare.5", "pedigree": { "ancestors": [ { "name": "tomcat-coyote", "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109", "type": "library", "group": "org.apache.tomcat", "version": "7.0.109" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2013-4590", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.5" } ], "bom-ref": "urn:uuid:8e0ab740-7797-51db-a6cc-2ab0f7851677", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-4590 does not affect version 7.0.109-tuxcare.5 of org.apache.tomcat:tomcat-coyote. Tomcat 7.0.109 is not vulnerable as it is outside the affected ranges: [0, 6.0.37]", "justification": "code_not_present" } }, { "id": "CVE-2014-0095", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.5" } ], "bom-ref": "urn:uuid:8761b4d0-a4ee-5b3e-8a61-98e7f068c27c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0095 affects version 7.0.109-tuxcare.5 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2015-5174", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.5" } ], "bom-ref": "urn:uuid:12a35aba-d83a-549a-b07d-01594fab15bd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2015-5174 does not affect version 7.0.109-tuxcare.5 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 CVE-2015-5174 is not present in Tomcat 7.0.109-tuxcare.4. The upstream Apache fix (commit 90ca468fc6, April 2016) was already included in the official Tomcat 7.0.109 release (April 2021) before TuxCare adopted the repository. The fix uses an alternative approach (addedTrailingSlash logic) compared to the trunk patch (78688b0a30), but achieves the same security goal by preventing directory trave...", "justification": "code_not_present" } }, { "id": "CVE-2015-5346", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.5" } ], "bom-ref": "urn:uuid:941b1fca-aae2-5ea7-9500-99e56b2d1d91", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5346 affects version 7.0.109-tuxcare.5 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2016-0706", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.5" } ], "bom-ref": "urn:uuid:48607f57-47b8-5008-b9fb-23e9b6b6a367", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-0706 does not affect version 7.0.109-tuxcare.5 of org.apache.tomcat:tomcat-coyote. Tomcat 7.0.109 is not vulnerable as it is outside the affected ranges: [6.0.0, 6.0.45), [8.0.0.RC1, 8.0.31), [9.0.0.M1, 9.0.0.M2)", "justification": "code_not_present" } }, { "id": "CVE-2016-0763", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.5" } ], "bom-ref": "urn:uuid:1faa53f0-26a6-5ba3-aaa1-a78a1cff6027", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-0763 does not affect version 7.0.109-tuxcare.5 of org.apache.tomcat:tomcat-coyote. CVE-2016-0763 affects Apache Tomcat 7.0.0-7.0.67", "justification": "code_not_present" } }, { "id": "CVE-2016-6816", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.5" } ], "bom-ref": "urn:uuid:911e5a54-9bc6-5c50-9c65-657f72818848", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-6816 does not affect version 7.0.109-tuxcare.5 of org.apache.tomcat:tomcat-coyote. Version 7.0.109 is not vulnerable. Summary: CVE-2016-6816 is NOT present in this target repository. The target is running Apache Tomcat 7.0.109, which includes the fix introduced in version 7.0.73. The fix adds stricter character validation for HTTP request line parsing using HttpParser.isToken(), HttpParser.isNotRequestTarget(), and HttpParser.isHttpProtocol() methods.", "justification": "code_not_present" } }, { "id": "CVE-2016-6817", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.5" } ], "bom-ref": "urn:uuid:d0567745-acb9-52d6-af63-b19d49d77ab3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-6817 does not affect version 7.0.109-tuxcare.5 of org.apache.tomcat:tomcat-coyote. Version 7.0.109 is not vulnerable. Summary: Target repository is Tomcat 7.0.109-tuxcare.1, which does not have HTTP/2 support. CVE-2016-6817 affects the HTTP/2 header parser in Tomcat 9.0.0.M1 to 9.0.0.M11 and 8.5.0 to 8.5.6. Since HTTP/2 support was first introduced in Tomcat 8.5 and 9.0, and the target is running Tomcat 7.0.x, the vulnerable component (java/org/apache/coyote/http2/Http2Parser.java) does not exist in this codebase. Therefore, the vulnerability cannot exist.", "justification": "code_not_present" } }, { "id": "CVE-2016-8747", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.5" } ], "bom-ref": "urn:uuid:687ed110-5f47-57e2-86f4-dd1f3824bf80", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-8747 does not affect version 7.0.109-tuxcare.5 of org.apache.tomcat:tomcat-coyote. Version 7.0.109 is not vulnerable. Summary: CVE-2016-8747 does not affect the target repository. The target is Tomcat 7.0.109, which uses a fundamentally different architecture (byte arrays with System.arraycopy) that predates the vulnerable ByteBuffer refactoring introduced in Tomcat 8.5.7. The vulnerable class Http11InputBuffer.java does not exist in Tomcat 7.x.", "justification": "code_not_present" } }, { "id": "CVE-2017-5650", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.5" } ], "bom-ref": "urn:uuid:ad787a23-f3d2-58ea-8c76-3af8c12c2c86", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-5650 does not affect version 7.0.109-tuxcare.5 of org.apache.tomcat:tomcat-coyote. Version 7.0.109 is not vulnerable. Summary: Target repository (Apache Tomcat 7.0.109) does not contain HTTP/2 implementation. CVE-2017-5650 affects HTTP/2 GOAWAY frame handling in Tomcat 8.5.0-8.5.12 and 9.0.0.M1-9.0.0.M18. HTTP/2 support was first introduced in Tomcat 8.5.0, so Tomcat 7.x completely predates the vulnerable feature.", "justification": "code_not_present" } }, { "id": "CVE-2017-5651", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.5" } ], "bom-ref": "urn:uuid:320284ba-1ca9-5d8f-b3a3-b1ad8f73f2db", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-5651 does not affect version 7.0.109-tuxcare.5 of org.apache.tomcat:tomcat-coyote. CVE-2017-5651 affects Apache Tomcat 8.5.0-8.5.12 and 9.0.0.M1-9.0.0.M18 only; 7.0.x is not affected", "justification": "code_not_present" } }, { "id": "CVE-2017-7675", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.5" } ], "bom-ref": "urn:uuid:cace8208-1df8-56ef-9ea9-05efb731e230", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-7675 does not affect version 7.0.109-tuxcare.5 of org.apache.tomcat:tomcat-coyote. Version 7.0.109 is not vulnerable. Summary: Target repository is Tomcat 7.0.109, which does not contain HTTP/2 support. The vulnerability CVE-2017-7675 is specific to the HTTP/2 implementation that was introduced in Tomcat 8.5.0 and 9.0.0.M1. Since the vulnerable feature (HTTP/2) was never introduced in Tomcat 7.x, the target is not vulnerable.", "justification": "code_not_present" } }, { "id": "CVE-2019-0199", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.5" } ], "bom-ref": "urn:uuid:fc1def99-3b72-5c5e-9ac3-c15bc17ab25e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-0199 affects version 7.0.109-tuxcare.5 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2020-13934", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.5" } ], "bom-ref": "urn:uuid:01713e88-7f26-55a0-bb1c-42fdbaf84204", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-13934 does not affect version 7.0.109-tuxcare.5 of org.apache.tomcat:tomcat-coyote. CVE-2020-13934 affects Apache Tomcat 8.5.1-8.5.56 and 9.0.0.M5-9.0.36 only; 7.0.x is not affected", "justification": "code_not_present" } }, { "id": "CVE-2020-13943", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.5" } ], "bom-ref": "urn:uuid:57c2bda8-ff59-5185-bbed-35eba733e678", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-13943 affects version 7.0.109-tuxcare.5 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2020-17527", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.5" } ], "bom-ref": "urn:uuid:cbe440e7-216a-5004-ae27-50cc15d9fcbe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-17527 affects version 7.0.109-tuxcare.5 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2021-25122", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.5" } ], "bom-ref": "urn:uuid:876975c8-34ba-5588-80d7-99f201243da0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-25122 affects version 7.0.109-tuxcare.5 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2022-42252", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.5" } ], "bom-ref": "urn:uuid:d2b41956-aba0-5acb-b24b-c04a6dcdc520", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-42252 affects version 7.0.109-tuxcare.5 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2022-45143", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.5" } ], "bom-ref": "urn:uuid:bafe289b-3bc5-5708-abb4-787ad77e82e4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-45143 is fixed in version 7.0.109-tuxcare.5 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-24998", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.5" } ], "bom-ref": "urn:uuid:4ac776d6-2714-5323-a391-750b4e668819", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-24998 affects version 7.0.109-tuxcare.5 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-28709", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.5" } ], "bom-ref": "urn:uuid:b2462ac2-2e2f-586a-95f6-4309f0e1cfc6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-28709 affects version 7.0.109-tuxcare.5 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-34981", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.5" } ], "bom-ref": "urn:uuid:9e830073-ae52-52b0-82f0-5b825bb142a1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-34981 affects version 7.0.109-tuxcare.5 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-42794", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.5" } ], "bom-ref": "urn:uuid:c6bfdd82-6a7a-5e9d-aaef-357576432914", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-42794 does not affect version 7.0.109-tuxcare.5 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 Apache Tomcat 7.0.109 is NOT affected by CVE-2023-42794. The vulnerability was introduced in later versions (9.0.70-9.0.80, 8.5.85-8.5.93) when refactoring removed the finalize() cleanup method from DiskFileItem. Tomcat 7.0.109 has always had the finalize() method (lines 543-553) that provides the defense against temporary file accumulation. This method was present in the upstream Tomcat 7.0.10...", "justification": "code_not_present" } }, { "id": "CVE-2023-42795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.5" } ], "bom-ref": "urn:uuid:6deb3c05-6fa5-57c5-bf65-bae8ebc4b99d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-42795 affects version 7.0.109-tuxcare.5 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-44487", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.5" } ], "bom-ref": "urn:uuid:bb10671e-3bcd-5da6-be20-d82cbdca7a1d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-44487 affects version 7.0.109-tuxcare.5 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-45648", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.5" } ], "bom-ref": "urn:uuid:f07352bc-2250-59df-9682-b1f43b38e6b7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-45648 affects version 7.0.109-tuxcare.5 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-46589", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.5" } ], "bom-ref": "urn:uuid:478acc05-fb6a-5a6f-bcef-c08c792ac202", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-46589 affects version 7.0.109-tuxcare.5 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-21733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.5" } ], "bom-ref": "urn:uuid:6edc5d37-9201-5ec2-80dc-209d5b5f6bef", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-21733 affects version 7.0.109-tuxcare.5 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-24549", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.5" } ], "bom-ref": "urn:uuid:a8bbe9a9-10f1-5c0f-b794-69cd6abbe147", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-24549 affects version 7.0.109-tuxcare.5 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-34750", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.5" } ], "bom-ref": "urn:uuid:5f76c9d5-61f6-55a5-b8a0-6753785f70d3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-34750 affects version 7.0.109-tuxcare.5 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-38286", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.5" } ], "bom-ref": "urn:uuid:54801e10-e40e-54a5-91d9-4fa9c99814cd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38286 affects version 7.0.109-tuxcare.5 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-52317", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.5" } ], "bom-ref": "urn:uuid:c8ba44dc-dd7c-5539-802d-5efc52ab505f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-52317 affects version 7.0.109-tuxcare.5 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2025-31650", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.5" } ], "bom-ref": "urn:uuid:3a42e0a9-6fa6-5917-bea9-2b07c061cc9d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31650 affects version 7.0.109-tuxcare.5 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2025-48989", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.5" } ], "bom-ref": "urn:uuid:e1d2e675-57eb-5872-a15b-766cf6f53b87", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-48989 affects version 7.0.109-tuxcare.5 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2025-52434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.5" } ], "bom-ref": "urn:uuid:3a5ee5df-b9f3-5d0b-a8a6-f77fa06c1c45", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-52434 affects version 7.0.109-tuxcare.5 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2025-53506", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.5" } ], "bom-ref": "urn:uuid:9cef79c0-02ba-51fb-8339-6faab0c9a567", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-53506 affects version 7.0.109-tuxcare.5 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2025-66614", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.5" } ], "bom-ref": "urn:uuid:3c1acfc6-9af4-599e-8721-6a837900ad51", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66614 affects version 7.0.109-tuxcare.5 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-24733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.5" } ], "bom-ref": "urn:uuid:6e4fe8aa-9dc1-5df1-b9aa-6e9ad636ebe6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-24733 is fixed in version 7.0.109-tuxcare.5 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-24734", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.5" } ], "bom-ref": "urn:uuid:2376185e-bc7c-54e1-9b87-d42c903eae83", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24734 affects version 7.0.109-tuxcare.5 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-24880", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.5" } ], "bom-ref": "urn:uuid:3adf7598-4ece-5dfa-81d9-8aec9b659a7b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-24880 is fixed in version 7.0.109-tuxcare.5 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-29129", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.5" } ], "bom-ref": "urn:uuid:37a84c33-36c5-5829-a6a7-fd5d0229870f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-29129 affects version 7.0.109-tuxcare.5 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-32990", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.5" } ], "bom-ref": "urn:uuid:8c25df0a-cb45-5281-8452-b56941c8fb54", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-32990 affects version 7.0.109-tuxcare.5 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-34486", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.5" } ], "bom-ref": "urn:uuid:5ecdd30a-8e05-5f0e-88fa-e73dce34c219", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34486 is fixed in version 7.0.109-tuxcare.5 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-41293", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.5" } ], "bom-ref": "urn:uuid:3d0075da-4e27-58cb-8f92-9b7679706e40", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41293 affects version 7.0.109-tuxcare.5 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-53434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.5" } ], "bom-ref": "urn:uuid:edd25bbc-80d4-59c4-bd3e-447bd2bf5524", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53434 affects version 7.0.109-tuxcare.5 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-65637", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.5" } ], "bom-ref": "urn:uuid:38a2f089-d0f6-5802-9cf1-1a7bf2e69812", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65637 affects version 7.0.109-tuxcare.5 of org.apache.tomcat:tomcat-coyote." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.5" } ] }