{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:012af5b4-d4b1-54e6-8117-47a5e039f714", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat-coyote", "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1", "version": "9.0.24-tuxcare.1", "pedigree": { "ancestors": [ { "name": "tomcat-coyote", "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24", "type": "library", "group": "org.apache.tomcat", "version": "9.0.24" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-0095", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:75c201bb-cb3a-504b-881e-eee04b008341", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0095 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2016-6816", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:953c46a3-6ad2-5b4e-85df-e48d3eff0562", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-6816 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2017-5651", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:864be1ed-46b1-5809-8d36-653eb1945ef8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-5651 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2019-0199", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:74836e40-a37a-5a09-b5d0-b3fcd7dad806", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-0199 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2020-13934", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:b23aff51-2be0-5e8e-8030-153e3075f205", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-13934 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2020-13943", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:8306b6bb-53ea-5723-b54d-fb1f2bca90f2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-13943 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2020-17527", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:1e62118e-20a0-5926-a625-638936c43d5d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-17527 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2021-25122", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:acf96c23-2701-56a4-801d-5cf7ad88e384", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-25122 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2022-42252", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:00a36a61-6a55-57b0-89dc-6a2d38693ced", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-42252 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2022-45143", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:6408ae49-b2d6-5bf0-ada7-3fcdfcb33b92", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-45143 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote. Apache Tomcat 9.0.24 is not affected by CVE-2022-45143. The vulnerability concerns JsonErrorReportValve, a component that does not exist in version 9.0.24. JsonErrorReportValve was introduced in Tomcat 9.0.40. Version 9.0.24 only contains ErrorReportValve, which produces HTML error pages and properly escapes user-controlled data using Escape.htmlElementContent(). The CVE's stated affected range (9.0.40 to 9.0.68) accurately reflects when the vulnerable component was introduced.", "justification": "code_not_present" } }, { "id": "CVE-2023-24998", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:f16512e6-dc8d-5a98-9ae1-9c8f1d4137f3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-24998 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-28709", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:6c3d8810-cec5-53e1-a636-4de4cdd9f572", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-28709 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-34981", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:87dcf5fb-e7a1-5dea-becd-78179ca88814", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-34981 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-42794", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:50e75771-9823-5f03-bd03-bc8d032dfffc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-42794 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 Target version 9.0.24 is NOT AFFECTED by CVE-2023-42794. The vulnerability was introduced in versions 9.0.70-9.0.80 when an \"in progress refactoring\" removed the finalize() cleanup method from DiskFileItem.java. Version 9.0.24 predates this refactoring and still contains the original finalize() method (lines 549-558) that prevents temporary uploaded files from persisting indefinitely. The CVE a...", "justification": "code_not_present" } }, { "id": "CVE-2023-42795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:ed112a83-ce23-547f-a835-e7811bf05d6e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-42795 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-44487", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:d9d7d9cd-5f0a-5f55-af56-5f05a2e6224d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-44487 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-45648", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:4ea7887b-8689-583c-981b-a590796a4d35", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-45648 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-46589", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:42922256-20e0-52e2-b518-96dea9e3da11", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-46589 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-21733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:1626b47f-be41-5569-b801-70a07ae05eb3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-21733 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-24549", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:46797c2b-6185-5b6b-b152-e9eaa5b394d4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-24549 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-34750", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:bc02170c-5802-5fbd-8a57-e845ab5d7154", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-34750 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-38286", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:dbe2bdbc-6886-5343-bd4d-6d73e0680b9c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38286 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-52317", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:1fb15a9e-74ba-572a-98a8-cf382b90acf9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-52317 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2025-31650", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:93d85153-3b0e-5439-b772-64ca620a22f4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-31650 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote. Apache Tomcat 9.0.24 is not affected by CVE-2025-31650. The vulnerability affects HTTP/2 extensible priorities (RFC 9218) support, which was not implemented in this version. The target lacks all vulnerable code paths: PRIORITY_UPDATE frame handling, Priority.parsePriority() method, and priority HTTP header processing. The CVE's affected version range starts at 9.0.76, consistent with RFC 9218 support being added after 9.0.24.", "justification": "code_not_present" } }, { "id": "CVE-2025-48989", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:721f3334-1e45-5c38-8ca1-dc00781cc576", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48989 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2025-52434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:d8a04b6f-ae78-5d0a-a398-1b2822c68df6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-52434 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2025-53506", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:49d1379b-26bc-58fb-bc5c-4497032fd285", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-53506 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2025-66614", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:b4b6c3ff-5283-5981-913b-516c526cce42", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66614 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-24733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:963e98e3-37cf-5686-acba-b9c8ba675d1c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-24733 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-24734", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:7439e944-0913-514d-bc35-18a65ad82c06", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24734 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-24880", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:780ab694-de4f-5836-aa3c-30ce7d41f203", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24880 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-29129", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:6194a15b-f618-527f-af06-de86295d6bc8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-29129 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-32990", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:b56a0342-a8b1-598c-9d78-60d27ec7d44c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-32990 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 CVE-2026-32990 affects the checkSni() method in AbstractEndpoint.java, which validates SNI hostnames against protocol-level host headers. This method was introduced by CVE-2025-66614 in Tomcat versions 9.0.113+, 10.1.50+, and 11.0.15+. The current target (version 9.0.24) predates this feature entirely - the checkSni() method, strictSni configuration, and SNI-vs-protocol-hostname validation logi...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-41293", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:1b9d35a7-1a4c-5a9f-9329-0f8b910fc5ef", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41293 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-53434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:ff21363b-d02d-57c3-a0b4-e3f2008cf985", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53434 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-65637", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:9470063e-2852-5c6c-a7d0-664feaeecfd5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65637 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } ] }