{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:e027584e-28e3-5813-a2e1-f3e230d2ab26", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat-coyote", "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.46-tuxcare.1", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.46-tuxcare.1", "version": "8.5.46-tuxcare.1", "pedigree": { "ancestors": [ { "name": "tomcat-coyote", "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.46", "type": "library", "group": "org.apache.tomcat", "version": "8.5.46" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-0095", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:604ed5f6-9725-52db-9236-051bfe2da407", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0095 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2016-6816", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:1757f41e-754b-5af9-9851-7bc0502c1d2c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-6816 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-coyote. Target version 8.5.46 is NOT vulnerable to CVE-2016-6816. The upstream Apache fix (commit f96f5751d4 by Mark Thomas) was integrated in Apache Tomcat 8.5.7 (November 2016), well before version 8.5.46. The fix adds character validation to HTTP request line parsing (method, request target, protocol) via HttpParser.isToken(), isNotRequestTarget(), and isHttpProtocol() methods, preventing invalid characters from reaching response generation code. All three validation points are present and active in the target's Http11InputBuffer.java.", "justification": "code_not_present" } }, { "id": "CVE-2017-5651", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:e5c39efc-ca7d-5ebe-a451-a0e75949d579", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-5651 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-coyote. Target is stock Apache Tomcat 8.5.46 (HEAD detached at tag 8.5.46, authored by markt@apache.org). CVE-2017-5651 is the send-file-processing regression where a Processor could be added to the processor cache twice (fixed upstream in 8.5.13 / 9.0.0.M19 via BZ 60918). The affected range is 8.5.0\u20138.5.12 and 9.0.0.M1\u2013M18; 8.5.46 is well past that. Code inspection of java/org/apache/coyote/http11/Http11Processor.java confirms the full post-fix implementation is present and the pre-fix pattern is absent. The service loop declares SendfileState sendfileState = SendfileState.DONE (line 675), gates the keep-alive loop on sendfileState == SendfileState.DONE (line 678), calls sendfileState = processSendfile(socketWrapper) (line 867), and returns SocketState.SENDFILE exactly once when sendfileState == SendfileState.PENDING (lines 879-880). The method processSendfile(...) (lines 1678-1706) returns a SendfileState and only nulls sendfileData inside its own switch. The vulnerable pre-fix markers breakKeepAliveLoop() (boolean) and sendingWithSendfile are entirely absent (0 grep matches). The exact upstream patch commit 494429ca21 is in the target history and reachable from HEAD. This is an upstream/vendor fix already baked into the shipped version, not a TuxCare backport, so the vulnerable pattern is not present in HEAD => not_affected (code_not_present).", "justification": "code_not_present" } }, { "id": "CVE-2019-0199", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:01f39fa5-7112-5068-86ed-e980170fb968", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-0199 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2019-2684", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:d225d4a6-5e6d-52c1-9597-f444693cef8d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-2684 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 Tomcat 8.5.46 contains vulnerable JMX/RMI code that could expose CVE-2019-2684 (Java SE RMI deserialization), but this code is not reachable in the default shipped configuration. The vulnerable JmxRemoteLifecycleListener class exists in the codebase and uses the unpatched `LocateRegistry.createRegistry()` + `registry.bind()` pattern that allows unauthorized RMI registry modifications. However, ...", "justification": "code_not_reachable" } }, { "id": "CVE-2020-13934", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:cb2e266c-1f44-583e-8d72-f244fbf416eb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-13934 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2020-13943", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:9c1c7e4a-7a37-5024-87d3-86630e0d9fec", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-13943 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2020-17527", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:db3572c6-13aa-5b11-a8ad-bd331ef730c3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-17527 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2021-25122", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:bfbcfcdc-373e-5f2c-a26a-91e660204a88", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-25122 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2022-42252", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:d2ba12e9-910a-5404-aa54-92fff4d3c18d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-42252 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-coyote. Tomcat 8.5.46 is not affected by CVE-2022-42252. The vulnerability requires the presence of HttpParser.isControl() validation in header parsing that removes malformed headers without rejecting requests when rejectIllegalHeader=false. Version 8.5.46 lacks this intermediate validation entirely. Instead, a Content-Length header whose value contains a control character other than CR or LF (e.g., Content-Length: 12\\u000734) is kept by header parsing, then rejected by Ascii.parseLong() which throws NumberFormatException, triggering an HTTP 400 response. An invalid Content-Length header is therefore never discarded while the request continues to be processed, which is the condition this vulnerability depends on.", "justification": "code_not_present" } }, { "id": "CVE-2022-45143", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:99d29846-729b-5255-bfdd-3153aa37c091", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-45143 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-coyote. Tomcat 8.5.46 is not affected by CVE-2022-45143. The vulnerable component JsonErrorReportValve does not exist in this version - it was introduced later in version 8.5.83. Version 8.5.46 only has ErrorReportValve which produces HTML error pages, not JSON. The CVE correctly identifies 8.5.83 as the first affected version in the 8.5.x series. No JSON error reporting capability exists in 8.5.46, therefore the vulnerability pattern (unescaped user-controlled values in JSON output) cannot occur.", "justification": "code_not_present" } }, { "id": "CVE-2023-24998", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:4c622c9e-2b49-52f5-ab75-6be4b07b3e88", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-24998 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-28709", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:da354a16-ed5a-5f54-ba5b-9f220d6fb220", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-28709 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-34981", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:0fde1745-8ae8-52eb-bc0e-7aaa3013f434", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-34981 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-42794", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:b07cb8dd-f2af-5c2c-9d73-f9f81101afff", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-42794 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 Target version 8.5.46 is NOT affected by CVE-2023-42794. The vulnerability only affected versions 8.5.85-8.5.93, where a refactoring removed the finalize() method from DiskFileItem. Version 8.5.46 predates this refactoring and retains the original finalize() method that automatically deletes temporary files during garbage collection, preventing the disk exhaustion issue. The fix was already pre...", "justification": "code_not_present" } }, { "id": "CVE-2023-42795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:32a3d274-b8ba-5e29-9e80-3fa749c4c562", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-42795 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-44487", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:370d020d-9f6f-50d0-8941-941e7b07ee1b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-44487 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-45648", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:e48032c8-93ca-5e58-a6d9-094b17a1f400", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-45648 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-46589", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:5eb0a623-4c75-5312-8d7b-7720dc1c8b72", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-46589 is fixed in version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-21733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:cfb07647-c983-586d-a294-8bebc1c9cf43", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-21733 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-24549", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:6ca7cd21-edff-55ee-a628-31b72d48940a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-24549 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-34750", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:5e1b2d7f-0f38-529a-aba4-c63e9216e35b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-34750 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-38286", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:3c78b69f-c684-54e5-813d-47f5eb5e7aa9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38286 is fixed in version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-52317", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:fb7edb07-27df-5a3b-b3cc-bdb70c7abef0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-52317 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2025-31650", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:abbeb6bb-665c-50c5-9b56-5b2c5783a2c1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-31650 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-coyote. Target version 8.5.46 is NOT affected by CVE-2025-31650. The vulnerability requires RFC 9218 (HTTP/2 Extensible Priorities) support, which was not implemented until Tomcat 8.5.90. Version 8.5.46 only supports RFC 7540's binary PRIORITY frames and lacks the vulnerable text-based priority field parsing code entirely. The CVE explicitly states affected versions start from 8.5.90, and target 8.5.46 predates this by 44 minor versions.", "justification": "code_not_present" } }, { "id": "CVE-2025-48989", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:5e8e2536-75c7-519d-962b-c13528bb3ad0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-48989 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2025-52434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:16210726-2565-5d26-98e4-a181b4313d50", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-52434 is fixed in version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2025-53506", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:a3ff6595-e490-577b-acfd-ee35e5708df1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-53506 is fixed in version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2025-66614", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:9ad0e165-a36b-5ebd-8a97-54480cca72b8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66614 is fixed in version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-24733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:6cc7973a-986a-505f-b975-6fa8b37f2d3e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-24733 is fixed in version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-24734", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:518289f3-e7a4-573c-a04a-21a384eb12f5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24734 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-24880", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:4338d3cc-adf0-5154-a06c-ee3e649c00ff", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-24880 is fixed in version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-29129", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:8cc9418e-20b6-5ab7-9329-c3b940bed699", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-29129 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-32990", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:43edaff4-3a5e-50b5-abc4-2f5ecdc6d266", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-32990 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 Apache Tomcat 8.5.46 is not affected by CVE-2026-32990. This CVE fixes a case-sensitivity bug in the checkSni method that was introduced by the CVE-2025-66614 fix. Version 8.5.46 predates CVE-2025-66614 and does not contain the checkSni method at all, therefore the specific vulnerability pattern (case-sensitive protocolHostName comparison in checkSni's fallback clause) cannot exist in this vers...", "justification": "code_not_present" } }, { "id": "CVE-2026-41293", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:005e6655-e436-5b02-9288-f022e7fea7c4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41293 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-53434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:afcfddcc-04d5-5dfc-8123-5ad242d200e5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53434 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-65637", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:a7c35dfa-605a-5101-9490-c7874edb00e9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65637 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.46-tuxcare.1" } ] }