{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:5a26fa45-4514-5752-aeb1-02ad236d9a7c", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat-coyote", "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.46-tuxcare.11", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.46-tuxcare.11", "version": "9.0.46-tuxcare.11", "pedigree": { "ancestors": [ { "name": "tomcat-coyote", "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.46", "type": "library", "group": "org.apache.tomcat", "version": "9.0.46" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-0095", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.46-tuxcare.11" } ], "bom-ref": "urn:uuid:5024c0f1-05b8-5c6a-a70d-ece83e1a3509", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0095 affects version 9.0.46-tuxcare.11 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2016-6816", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.46-tuxcare.11" } ], "bom-ref": "urn:uuid:cd49d964-1b4f-5419-a6cb-11710e148f25", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-6816 affects version 9.0.46-tuxcare.11 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2017-5651", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.46-tuxcare.11" } ], "bom-ref": "urn:uuid:543f7667-1d72-5980-abe0-9f98ccbfe04f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-5651 affects version 9.0.46-tuxcare.11 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2019-0199", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.46-tuxcare.11" } ], "bom-ref": "urn:uuid:c3821fa0-682f-50ba-a495-6bdb5f43ee33", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-0199 affects version 9.0.46-tuxcare.11 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2020-13934", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.46-tuxcare.11" } ], "bom-ref": "urn:uuid:5fcb9898-0b40-5016-8c25-6af02b4019f7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-13934 does not affect version 9.0.46-tuxcare.11 of org.apache.tomcat:tomcat-coyote. CVE-2020-13934 affects Apache Tomcat 9.0.0.M5-9.0.36", "justification": "code_not_present" } }, { "id": "CVE-2020-13943", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.46-tuxcare.11" } ], "bom-ref": "urn:uuid:b253f00a-e839-5dac-9bca-2343f4ac67c1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-13943 does not affect version 9.0.46-tuxcare.11 of org.apache.tomcat:tomcat-coyote. Version 9.0.46 is not vulnerable. Summary: The target repository has the CVE-2020-13943 fix already applied. The max concurrent streams validation check has been correctly moved from headersStart() to headersEnd() method, and the method signature has been updated from ConnectionException to Http2Exception as per the vendor's patch. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "code_not_present" } }, { "id": "CVE-2020-17527", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.46-tuxcare.11" } ], "bom-ref": "urn:uuid:e4f5f07b-e7f1-5b9b-ac41-2f6fc629fda9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-17527 affects version 9.0.46-tuxcare.11 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2021-25122", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.46-tuxcare.11" } ], "bom-ref": "urn:uuid:f9e333ce-f0ff-5122-b442-619dc59b1d43", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-25122 affects version 9.0.46-tuxcare.11 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2022-42252", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.46-tuxcare.11" } ], "bom-ref": "urn:uuid:c4bd4c43-ec74-5e57-9aa5-49d7a90fe944", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-42252 is fixed in version 9.0.46-tuxcare.11 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2022-45143", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.46-tuxcare.11" } ], "bom-ref": "urn:uuid:dd1363a6-bf67-550b-84f7-bb3367fdaa44", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-45143 is fixed in version 9.0.46-tuxcare.11 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-24998", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.46-tuxcare.11" } ], "bom-ref": "urn:uuid:08c07d27-a27e-5b92-8c28-7caaabdb5500", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-24998 is fixed in version 9.0.46-tuxcare.11 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-28709", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.46-tuxcare.11" } ], "bom-ref": "urn:uuid:0a7cb6f9-3fc3-512b-b217-b02420d39d2e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-28709 is fixed in version 9.0.46-tuxcare.11 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-34981", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.46-tuxcare.11" } ], "bom-ref": "urn:uuid:325fea48-9066-5afc-b1d2-84ab5823ad4a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-34981 affects version 9.0.46-tuxcare.11 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-42794", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.46-tuxcare.11" } ], "bom-ref": "urn:uuid:72a5143d-928a-502e-be42-e0eb448e6168", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-42794 does not affect version 9.0.46-tuxcare.11 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 Target version 9.0.46 is not affected by CVE-2023-42794. The vulnerability was introduced in Tomcat 9.0.70-9.0.80 during an unreleased refactoring that removed the finalize() method from DiskFileItem.java, causing temporary files to remain on disk when streams were not properly closed. Version 9.0.46 predates this refactoring and retains the original finalize() method (lines 548-559) that provi...", "justification": "code_not_present" } }, { "id": "CVE-2023-42795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.46-tuxcare.11" } ], "bom-ref": "urn:uuid:7b64f885-20a9-5969-837d-03b306b6f580", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-42795 is fixed in version 9.0.46-tuxcare.11 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-44487", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.46-tuxcare.11" } ], "bom-ref": "urn:uuid:b07738f9-31fc-5f9d-a087-cdd4b1559b38", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-44487 is fixed in version 9.0.46-tuxcare.11 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-45648", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.46-tuxcare.11" } ], "bom-ref": "urn:uuid:5bf584a3-472e-5b5f-94d5-a8b0aa0d8d24", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-45648 is fixed in version 9.0.46-tuxcare.11 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-46589", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.46-tuxcare.11" } ], "bom-ref": "urn:uuid:97836ae8-3046-5eed-b00d-85ca0688df14", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-46589 is fixed in version 9.0.46-tuxcare.11 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-21733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.46-tuxcare.11" } ], "bom-ref": "urn:uuid:d1d9f036-025c-51cd-bd88-09999ad0aa36", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-21733 affects version 9.0.46-tuxcare.11 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-24549", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.46-tuxcare.11" } ], "bom-ref": "urn:uuid:640c4f7b-8ef8-51a2-a67a-69d8dda02f32", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-24549 is fixed in version 9.0.46-tuxcare.11 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-34750", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.46-tuxcare.11" } ], "bom-ref": "urn:uuid:2682cef1-0f84-50a7-bcfe-4e2cec145b9e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-34750 affects version 9.0.46-tuxcare.11 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-38286", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.46-tuxcare.11" } ], "bom-ref": "urn:uuid:7df383e8-a3fc-5764-8109-9b4fdd6285f7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38286 is fixed in version 9.0.46-tuxcare.11 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-52317", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.46-tuxcare.11" } ], "bom-ref": "urn:uuid:4631cf35-388d-5c7d-a69d-75deca7c6911", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-52317 affects version 9.0.46-tuxcare.11 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2025-31650", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.46-tuxcare.11" } ], "bom-ref": "urn:uuid:41c84449-d5b1-53c5-9dec-699a1ecaae55", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-31650 does not affect version 9.0.46-tuxcare.11 of org.apache.tomcat:tomcat-coyote. Version 9.0.46 is not vulnerable. Summary: The target repository is running Apache Tomcat version 9.0.46, which predates the affected version range for CVE-2025-31650. The vulnerability affects versions 9.0.76 through 9.0.102 for Tomcat 9.x, and this version (9.0.46) is not within that range. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "code_not_present" } }, { "id": "CVE-2025-48989", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.46-tuxcare.11" } ], "bom-ref": "urn:uuid:c2a6917a-e927-5ff0-a9fc-6044fa12808e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48989 is fixed in version 9.0.46-tuxcare.11 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2025-52434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.46-tuxcare.11" } ], "bom-ref": "urn:uuid:e4f2ff26-7a6e-55af-8cc3-c8b25dbcbf6a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-52434 is fixed in version 9.0.46-tuxcare.11 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2025-53506", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.46-tuxcare.11" } ], "bom-ref": "urn:uuid:6278864e-9908-561a-bd5f-818fbf630855", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-53506 is fixed in version 9.0.46-tuxcare.11 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2025-66614", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.46-tuxcare.11" } ], "bom-ref": "urn:uuid:567db4c8-41c6-53b4-ae2c-d9763b23b690", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66614 is fixed in version 9.0.46-tuxcare.11 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-24733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.46-tuxcare.11" } ], "bom-ref": "urn:uuid:9271dd35-ab57-5167-8e27-24ee87a7fd6b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-24733 is fixed in version 9.0.46-tuxcare.11 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-24734", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.46-tuxcare.11" } ], "bom-ref": "urn:uuid:43a3561d-a7c1-58ab-8307-bdc34a5f17db", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24734 affects version 9.0.46-tuxcare.11 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-24880", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.46-tuxcare.11" } ], "bom-ref": "urn:uuid:64f4e443-0bf5-5154-bcc7-07d2ca2827d3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24880 affects version 9.0.46-tuxcare.11 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-29129", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.46-tuxcare.11" } ], "bom-ref": "urn:uuid:d4cd303c-d3dd-5447-8fca-b59936d7edeb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-29129 affects version 9.0.46-tuxcare.11 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-32990", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.46-tuxcare.11" } ], "bom-ref": "urn:uuid:e0c2a3f1-6272-5c8d-8a0e-d9e628ae9364", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-32990 affects version 9.0.46-tuxcare.11 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-41293", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.46-tuxcare.11" } ], "bom-ref": "urn:uuid:792f2b3b-1d9e-56f9-9436-6e9333bc1a11", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41293 affects version 9.0.46-tuxcare.11 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-53434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.46-tuxcare.11" } ], "bom-ref": "urn:uuid:5455842c-b007-5960-9d8f-44110dba7d3b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53434 affects version 9.0.46-tuxcare.11 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-65637", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.46-tuxcare.11" } ], "bom-ref": "urn:uuid:bcf76c37-c433-5bd3-a9bc-d8725d72fea4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65637 affects version 9.0.46-tuxcare.11 of org.apache.tomcat:tomcat-coyote." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.46-tuxcare.11" } ] }