{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:ba24a3ad-e2db-5a7c-a2e8-95e9c49a2423", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat-coyote", "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.78-tuxcare.2", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.78-tuxcare.2", "version": "8.5.78-tuxcare.2", "pedigree": { "ancestors": [ { "name": "tomcat-coyote", "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.78", "type": "library", "group": "org.apache.tomcat", "version": "8.5.78" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-0095", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:8df3b53c-aac1-5264-9c2b-08ffa1a92282", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0095 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2016-6816", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:95696094-2bc5-523d-a34f-1501d47c90ea", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-6816 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-coyote. CVE-2016-6816 is NOT present in Apache Tomcat 8.5.78. The vulnerability affected versions 8.5.0-8.5.6, allowing invalid characters in HTTP request lines to enable response splitting attacks. The upstream fix by Mark Thomas (commit f96f5751d41, Nov 2016) added character validation via HttpParser.isNotRequestTarget() and HttpParser.isHttpProtocol() methods. These validations are present and active in the target at Http11InputBuffer.java lines 510 and 583, rejecting invalid characters before they reach response generation. The fix was already included in the upstream Apache Tomcat 8.5.78 release that TuxCare onboarded (commit fb98844404), making this an upstream-authored fix rather than a TuxCare backport.", "justification": "code_not_present" } }, { "id": "CVE-2017-5651", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:ace95d5d-7b7e-5d0e-8951-b58957468a3d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-5651 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-coyote. The target Apache Tomcat 8.5.78 is NOT affected by CVE-2017-5651. The vulnerability (sendfile processor cache corruption leading to response mix-up) was fixed by upstream Apache developer Mark Thomas in commit 494429ca21 (bug 60918) dated March 24, 2017. This fix was already present in the upstream Apache Tomcat 8.5.78 release that TuxCare onboarded, as confirmed by git ancestry analysis showing the fix commit predates the TuxCare onboarding commit fb98844404 by 3599 commits. Code inspection confirms all fix elements are correctly implemented: SendfileState tracking variable, modified loop condition, processSendfile() method returning state, and removal of premature sendfileData clearing from prepareRequest().", "justification": "code_not_present" } }, { "id": "CVE-2019-0199", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:d6968c57-2dd9-53ce-b6b8-b701d100c4dd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-0199 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2020-13934", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:8e42a7ed-3c00-5e3f-acb8-b29e0140527b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-13934 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-coyote. Target version 8.5.78 is not affected by CVE-2020-13934. The vulnerability (failure to release HTTP/1.1 processor after h2c upgrade leading to memory exhaustion) was fixed in upstream Apache Tomcat by commit 923d834500 authored by Mark Thomas (markt@apache.org). This fix was included in the upstream 8.5.78 release, which is newer than the last affected version (8.5.56). The target repository contains the complete fix: the HTTP/1.1 processor is properly released via `release(processor)` before creating the HTTP/2 upgrade processor, and the control flow correctly uses `state = SocketState.CLOSED` to trigger cleanup.", "justification": "code_not_present" } }, { "id": "CVE-2020-13943", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:e8a7e006-01c9-5ff8-a697-97cacbea0943", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-13943 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 Apache Tomcat 8.5.78 is not affected by CVE-2020-13943. The upstream fix was already present in version 8.5.78 when TuxCare onboarded it. The CVE affects versions 8.5.0 to 8.5.57; this is 8.5.78. The vulnerability involved HTTP/2 header confusion when concurrent stream limits were exceeded due to checking limits during initial header parsing (headersStart) rather than after complete parsing (he...", "justification": "code_not_present" } }, { "id": "CVE-2020-17527", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:c5c40858-d4c2-5ae8-bd95-e8dfbdaed4f4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-17527 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2021-25122", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:fa5000f2-b8cd-5811-8a83-32de86a133dc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-25122 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2022-42252", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:dcb19015-a9da-590c-b23d-582c052b4dd8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-42252 is fixed in version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2022-45143", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:5a91a24a-78b5-5cf0-8059-bba45cf976dd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-45143 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-coyote. CVE-2022-45143 affects JsonErrorReportValve, which does not exist in Tomcat 8.5.78. The vulnerability involves missing JSON escaping in type/message/description fields. The target version only has ErrorReportValve, which generates HTML error reports with proper HTML escaping (Escape.htmlElementContent). JsonErrorReportValve was introduced upstream on 2020-10-14 in versions 8.5.83+, 9.0.40+, and 10.1.0+, never backported to 8.5.78. The attack chain (user-provided error data \u2192 manipulated JSON output) cannot complete because JSON error reporting does not exist in the target. Verdict: not_affected per Rule 5 Type A2 (input received but chain to Goal broken by missing JSON generation).", "justification": "code_not_reachable" } }, { "id": "CVE-2023-24998", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:f50fe3b6-f6ea-5fd6-a879-61568d84fb41", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-24998 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-28709", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:190d98b3-f4ef-5542-9152-325bb3a8f681", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-28709 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-34981", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:30f84087-b7a0-5abf-9057-e87753ee6865", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-34981 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-42794", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:6f387a15-57df-5751-93ff-78420c7b99f3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-42794 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 Apache Tomcat 8.5.78-tuxcare.3 is not affected by CVE-2023-42794. The vulnerability was introduced by a refactoring in version 8.5.85 that removed the finalize() cleanup method from DiskFileItem.java. Since the target version (8.5.78) predates this refactoring, it retains the original finalize() method (lines 538-548) that provides automatic cleanup of temporary uploaded files during garbage co...", "justification": "code_not_present" } }, { "id": "CVE-2023-42795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:c959267b-db04-58d9-9c51-9e6e65284804", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-42795 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-44487", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:56b4e69d-f319-5cda-9106-320feedca46d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-44487 is fixed in version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-45648", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:510eaed2-578c-5009-a969-de72983052b9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-45648 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-46589", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:c81f01a6-3bdf-516e-af26-d986434578ad", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-46589 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-21733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:4d3d2a72-fff9-57c7-b03e-cfda3566d092", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-21733 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-24549", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:541db2bb-2f97-5027-a10b-838593c4cdde", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-24549 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-34750", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:598cd18f-2f65-56f0-b041-e1633d77dfe3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-34750 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-38286", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:e1c15cea-9d73-53fa-b14e-d33b432452ff", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38286 is fixed in version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-52317", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:80560c1f-7ea5-59d3-98e4-df65c66f38ea", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-52317 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2025-31650", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:64b5f662-b6a4-52f3-b62f-aced71cc1ed2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-31650 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-coyote. Apache Tomcat 8.5.78 is NOT AFFECTED by CVE-2025-31650. This vulnerability requires RFC 9218 HTTP Extensible Priorities support, which was not introduced until version 8.5.90. Version 8.5.78 lacks the Priority class, PRIORITY_UPDATE frame type, readPriorityUpdateFrame() method, and all priority header parsing code that contains the vulnerability. The CVE's affected version range (8.5.90-8.5.100) correctly excludes 8.5.78.", "justification": "code_not_present" } }, { "id": "CVE-2025-48989", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:ff54c96e-95d8-5af1-9999-e0a18ca652ee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-48989 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2025-52434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:d5dafbd2-94a2-5381-b76b-8417f6bfb0fe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-52434 is fixed in version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2025-53506", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:a0aea4da-a285-5607-8f46-5c3d361156d0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-53506 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2025-66614", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:4ddab74e-7940-5918-bad5-17654c375ec7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66614 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-24733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:cf9d7189-eecc-57a4-b330-b81502fcdcc4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-24733 is fixed in version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-24734", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:fd854af5-bb64-5d35-ac95-a868c127afa8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24734 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-24880", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:66c9804d-6864-51c2-badc-3c9e0a06732c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-24880 is fixed in version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-29129", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:32a884ca-490b-507d-abf2-91475fe709ba", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-29129 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-32990", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:77bf1b05-2e21-5405-864a-0092bf580c66", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-32990 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 Apache Tomcat 8.5.78 is not affected by CVE-2026-32990. The vulnerability requires the checkSni() method introduced in CVE-2025-66614, which was backported to version 8.5.100. Version 8.5.78 predates this feature and lacks the vulnerable code path entirely. The SNI validation framework that compares protocol hostname with SNI hostname does not exist in 8.5.78.", "justification": "code_not_present" } }, { "id": "CVE-2026-41293", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:e55e06ff-eeff-56e4-a0b2-bd55d4e2691f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41293 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-53434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:a6eb4ac5-3408-5787-870c-3bcd093d4d45", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53434 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-65637", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:2c1363e4-52e5-5707-b3ba-f612428f05c5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65637 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-coyote." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.78-tuxcare.2" } ] }