{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:31128641-e0c9-5a73-8d48-90c8954ad324", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat-coyote", "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.70-tuxcare.5", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.70-tuxcare.5", "version": "7.0.70-tuxcare.5", "pedigree": { "ancestors": [ { "name": "tomcat-coyote", "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.70", "type": "library", "group": "org.apache.tomcat", "version": "7.0.70" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2012-5568", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.70-tuxcare.5" } ], "bom-ref": "urn:uuid:9c38967f-9ceb-54f3-be68-c1fcade39af9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5568 affects version 7.0.70-tuxcare.5 of org.apache.tomcat:tomcat-coyote and will not be fixed. Apache does not treat CVE-2012-5568 as a Tomcat vulnerability and ships no fix; mitigation is connector configuration.", "response": [ "will_not_fix" ] } }, { "id": "CVE-2014-0095", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.70-tuxcare.5" } ], "bom-ref": "urn:uuid:5a9dc2e1-abf0-5514-b3f6-fd34af5be379", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0095 affects version 7.0.70-tuxcare.5 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2016-6816", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.70-tuxcare.5" } ], "bom-ref": "urn:uuid:8bd9f44e-cc49-54e7-8275-a62335c6fd4b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2016-6816 is fixed in version 7.0.70-tuxcare.5 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2016-8745", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.70-tuxcare.5" } ], "bom-ref": "urn:uuid:026a13cd-9392-57c9-b375-4a8609b27796", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2016-8745 is fixed in version 7.0.70-tuxcare.5 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2017-5651", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.70-tuxcare.5" } ], "bom-ref": "urn:uuid:b6e4515d-4161-5948-9c78-0af91fee1135", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-5651 does not affect version 7.0.70-tuxcare.5 of org.apache.tomcat:tomcat-coyote. Tomcat 7.0.70 is not affected by CVE-2017-5651. This vulnerability was introduced during the HTTP connector refactoring for Tomcat 8.5.x onwards and does not exist in Tomcat 7.x. The target uses a pre-refactoring architecture with separate sendfile state tracking via the `sendfileInProgress` boolean flag, which inherently prevents the race condition that allows a Processor to be added to the cache twice. The vulnerable code pattern (relying solely on `sendfileData != null` for state determination) is not present in version 7.0.70.", "justification": "code_not_present" } }, { "id": "CVE-2019-0199", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.70-tuxcare.5" } ], "bom-ref": "urn:uuid:d4d4c063-861a-5384-8646-6dd0a4ba4606", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-0199 affects version 7.0.70-tuxcare.5 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2019-2684", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.70-tuxcare.5" } ], "bom-ref": "urn:uuid:f3b9ab5f-73b3-5a36-a4c2-687e96af902c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-2684 is fixed in version 7.0.70-tuxcare.5 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2020-13934", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.70-tuxcare.5" } ], "bom-ref": "urn:uuid:16b2fddc-706b-50e4-9673-5a7492df5581", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-13934 does not affect version 7.0.70-tuxcare.5 of org.apache.tomcat:tomcat-coyote. Tomcat 7.0.70 is not affected by CVE-2020-13934. The vulnerability requires HTTP/2 (h2c) protocol support to leak HTTP/1.1 processors during direct h2c connections. HTTP/2 support was first introduced in Tomcat 8.5/9.0 (circa 2016), and version 7.0.70 predates this feature entirely. The target codebase contains no HTTP/2 implementation, no h2c upgrade handling, and no UpgradeProtocol interface used by the vulnerable code pattern.", "justification": "code_not_present" } }, { "id": "CVE-2020-13943", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.70-tuxcare.5" } ], "bom-ref": "urn:uuid:a249f94b-48bd-53d9-bcff-793e88238458", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-13943 does not affect version 7.0.70-tuxcare.5 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 The target repository (Apache Tomcat 7.0.70 at commit a78de4bfa3) does not contain HTTP/2 protocol support. CVE-2020-13943 affects the HTTP/2 implementation in the org.apache.coyote.http2 package, which does not exist in this version. HTTP/2 support was introduced in Tomcat 8.5.0+; version 7.0.70 only supports HTTP/1.1 and AJP protocols. The vulnerability's attack vector (HTTP/2 HEADERS frames ...", "justification": "code_not_present" } }, { "id": "CVE-2020-17527", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.70-tuxcare.5" } ], "bom-ref": "urn:uuid:a728d3f5-214e-544b-9f34-2fc70f00bd1c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-17527 affects version 7.0.70-tuxcare.5 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2021-25122", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.70-tuxcare.5" } ], "bom-ref": "urn:uuid:62843587-d99c-550e-a573-5b80bf4b6dd0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-25122 affects version 7.0.70-tuxcare.5 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2022-42252", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.70-tuxcare.5" } ], "bom-ref": "urn:uuid:bcc786f4-1cf0-5b85-b39f-1e71117f8475", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-42252 affects version 7.0.70-tuxcare.5 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2022-45143", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.70-tuxcare.5" } ], "bom-ref": "urn:uuid:54467e01-4b59-5c31-a636-ff1a0ef727f5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-45143 does not affect version 7.0.70-tuxcare.5 of org.apache.tomcat:tomcat-coyote. Tomcat 7.0.70 is not affected by CVE-2022-45143. The vulnerable component JsonErrorReportValve does not exist in this version - it was introduced 4+ years later in Tomcat 9.0.40 (October 2020). Tomcat 7.0.70 only has ErrorReportValve, which outputs HTML error pages, not JSON. The attack chain requires JSON output to reach the Goal (manipulated JSON), but no JSON error reporting capability exists in this version.", "justification": "code_not_present" } }, { "id": "CVE-2023-24998", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.70-tuxcare.5" } ], "bom-ref": "urn:uuid:8a76548f-3ce8-5334-b6c0-1aa8576021e8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-24998 is fixed in version 7.0.70-tuxcare.5 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-28709", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.70-tuxcare.5" } ], "bom-ref": "urn:uuid:6f894bfc-0d15-581d-aa7a-c635204116c6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-28709 is fixed in version 7.0.70-tuxcare.5 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-34981", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.70-tuxcare.5" } ], "bom-ref": "urn:uuid:94a9babe-84d3-511a-8eb5-4b2c4f17051f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-34981 affects version 7.0.70-tuxcare.5 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-42794", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.70-tuxcare.5" } ], "bom-ref": "urn:uuid:05495138-618d-5d52-a4cb-faf61a2aee19", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-42794 does not affect version 7.0.70-tuxcare.5 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 Tomcat 7.0.70 is NOT affected by CVE-2023-42794. The vulnerability exists in Tomcat 9.0.70-9.0.80 and 8.5.85-8.5.93 where an in-progress refactoring completely removed the finalize() method, preventing temporary file cleanup during garbage collection. Version 7.0.70 retains a functional finalize() method (lines 552-559 of DiskFileItem.java) that successfully deletes temporary files when objects...", "justification": "code_not_reachable" } }, { "id": "CVE-2023-42795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.70-tuxcare.5" } ], "bom-ref": "urn:uuid:47f25fe2-fa34-55a3-8aac-e8abb958f48b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-42795 affects version 7.0.70-tuxcare.5 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-44487", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.70-tuxcare.5" } ], "bom-ref": "urn:uuid:a27371c1-7674-55d8-9243-5bf40106e89a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-44487 affects version 7.0.70-tuxcare.5 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-45648", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.70-tuxcare.5" } ], "bom-ref": "urn:uuid:da0e8095-d5f3-5130-b206-f1c8cc954735", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-45648 affects version 7.0.70-tuxcare.5 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-46589", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.70-tuxcare.5" } ], "bom-ref": "urn:uuid:b68a4094-d155-5065-951d-3ba5d7e96225", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-46589 affects version 7.0.70-tuxcare.5 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-21733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.70-tuxcare.5" } ], "bom-ref": "urn:uuid:1bfa4550-66e5-5065-83db-213b1f64f943", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-21733 affects version 7.0.70-tuxcare.5 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-24549", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.70-tuxcare.5" } ], "bom-ref": "urn:uuid:4afc8003-3f8b-57d6-a56d-2cc9afe3e318", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-24549 does not affect version 7.0.70-tuxcare.5 of org.apache.tomcat:tomcat-coyote. Tomcat 7.0.70 is not affected by CVE-2024-24549. This vulnerability is specific to HTTP/2 header processing in Apache Tomcat, where streams were not reset until after all headers (including CONTINUATION frames) were processed when limits were exceeded. HTTP/2 support was introduced in Tomcat 8.5.0, and version 7.0.70 predates this feature entirely. The target codebase contains only HTTP/1.1 and AJP protocol implementations, which already enforce header size limits incrementally during parsing, not after completion.", "justification": "code_not_present" } }, { "id": "CVE-2024-34750", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.70-tuxcare.5" } ], "bom-ref": "urn:uuid:e83ddc51-3d3e-5820-96f4-74ef91c07259", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-34750 affects version 7.0.70-tuxcare.5 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-38286", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.70-tuxcare.5" } ], "bom-ref": "urn:uuid:e1a7a1bb-49b4-5ebf-894a-2607c201c1ee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38286 affects version 7.0.70-tuxcare.5 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-52317", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.70-tuxcare.5" } ], "bom-ref": "urn:uuid:4d5edc15-d033-579d-8d70-ca5f6a1dc80f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-52317 affects version 7.0.70-tuxcare.5 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2025-31650", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.70-tuxcare.5" } ], "bom-ref": "urn:uuid:b877d723-cd8b-5707-803a-6154b372dd3c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-31650 does not affect version 7.0.70-tuxcare.5 of org.apache.tomcat:tomcat-coyote. Apache Tomcat 7.0.70 is NOT affected by CVE-2025-31650. This vulnerability targets HTTP/2 priority header parsing code that does not exist in Tomcat 7.0.x. HTTP/2 support was added in Tomcat 8.5+. The target lacks all HTTP/2 infrastructure (no http2 package, no Priority parsing, no HTTP/2 upgrade handlers), so the vulnerable INPUT type (invalid HTTP/2 priority headers/frames) is never received by the target codebase.", "justification": "code_not_present" } }, { "id": "CVE-2025-48989", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.70-tuxcare.5" } ], "bom-ref": "urn:uuid:32410153-76b9-5aff-986a-06079884bde8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-48989 affects version 7.0.70-tuxcare.5 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2025-52434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.70-tuxcare.5" } ], "bom-ref": "urn:uuid:8430e603-d973-56b1-a3c6-c492afc4009f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-52434 affects version 7.0.70-tuxcare.5 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2025-53506", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.70-tuxcare.5" } ], "bom-ref": "urn:uuid:b4426978-a92f-5edd-b887-cae235537b73", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-53506 affects version 7.0.70-tuxcare.5 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2025-66614", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.70-tuxcare.5" } ], "bom-ref": "urn:uuid:83f65f11-87b8-5aac-9da1-fd634224fa4a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-66614 does not affect version 7.0.70-tuxcare.5 of org.apache.tomcat:tomcat-coyote. Tomcat 7.0.70 is not affected by CVE-2025-66614. The vulnerability requires SNI (Server Name Indication) support to extract the TLS SNI hostname and SSLHostConfig-based per-virtual-host TLS configurations to enable different client certificate authentication requirements per virtual host. Tomcat 7.0.70 does not support SNI - this feature was introduced in Tomcat 8.5 (confirmed by the target's own documentation in ssl-howto.xml). The CVE explicitly states \"Older EOL versions are not affected\", and version 7.0.70 predates the 8.5.0 threshold. Code analysis confirms no SNI extraction code, no SSLHostConfig class, and no Java SNI APIs are present in 7.0.70.", "justification": "code_not_present" } }, { "id": "CVE-2026-24733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.70-tuxcare.5" } ], "bom-ref": "urn:uuid:22c8d1ca-4f91-506b-8c81-5598d904dd98", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24733 affects version 7.0.70-tuxcare.5 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-24734", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.70-tuxcare.5" } ], "bom-ref": "urn:uuid:0ae500df-78a9-5e66-9cd8-a3114cd3600b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24734 affects version 7.0.70-tuxcare.5 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-24880", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.70-tuxcare.5" } ], "bom-ref": "urn:uuid:7d6b2908-f91d-570c-b7d3-5e71356aafc9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24880 affects version 7.0.70-tuxcare.5 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-29129", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.70-tuxcare.5" } ], "bom-ref": "urn:uuid:b5f8db7a-d31f-5ae0-919e-29684a3ac30b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-29129 affects version 7.0.70-tuxcare.5 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-32990", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.70-tuxcare.5" } ], "bom-ref": "urn:uuid:56d51453-38c3-53f8-b99f-365448101f6b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-32990 does not affect version 7.0.70-tuxcare.5 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 Tomcat 7.0.70 is not affected by CVE-2026-32990. The vulnerability exists in the SNI (Server Name Indication) hostname validation code (checkSni method in AbstractEndpoint.java) which performs case-sensitive comparison when looking up SSL configurations. This SNI validation architecture, including the SSLHostConfig class and checkSni method, was introduced in Tomcat 8.5+ and does not exist in T...", "justification": "code_not_present" } }, { "id": "CVE-2026-41293", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.70-tuxcare.5" } ], "bom-ref": "urn:uuid:0811fa2a-b720-512b-99c8-084043f53ea4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41293 does not affect version 7.0.70-tuxcare.5 of org.apache.tomcat:tomcat-coyote. Tomcat 7.0.70 is not affected by CVE-2026-41293. The vulnerability concerns improper character validation in HTTP/2 HPACK header decoding. Tomcat 7.0.70 does not include HTTP/2 protocol support - it only supports HTTP/1.1 and AJP. HTTP/2 support was introduced in Tomcat 8.5 and later versions. The vulnerable code (HPackHuffman, HpackDecoder, Http2Parser classes and associated validation methods) is entirely absent from this version. Exhaustive search confirmed no http2 package, no HTTP/2 Java files, and no HTTP/2 protocol handlers exist in the codebase.", "justification": "code_not_present" } }, { "id": "CVE-2026-53434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.70-tuxcare.5" } ], "bom-ref": "urn:uuid:8fdcab7f-2592-5242-9c56-34f96dac8eeb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53434 affects version 7.0.70-tuxcare.5 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-65637", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.70-tuxcare.5" } ], "bom-ref": "urn:uuid:2d9f3e81-e192-5113-b83d-bbaa454e52e8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65637 affects version 7.0.70-tuxcare.5 of org.apache.tomcat:tomcat-coyote." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.70-tuxcare.5" } ] }