{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:f2bc774f-e53a-51fa-adfa-b6da9d280004", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat-coyote", "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.50-tuxcare.16", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.50-tuxcare.16", "version": "9.0.50-tuxcare.16", "pedigree": { "ancestors": [ { "name": "tomcat-coyote", "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.50", "type": "library", "group": "org.apache.tomcat", "version": "9.0.50" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-0095", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:7b7ab39f-4a4d-583b-8ed5-a7fc13b0c210", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0095 affects version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2016-6816", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:67909940-ffdc-5e08-b8b1-f0d0e5e68560", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-6816 affects version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2017-5651", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:57dc21b7-5a36-503f-8569-72fa3fbcc092", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-5651 affects version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2019-0199", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:184f1dc8-3f4b-53af-bc83-1ff0508ed382", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-0199 affects version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2020-13934", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:aa25b371-503e-5bf7-b704-66626d6941cf", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-13934 does not affect version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-coyote. CVE-2020-13934 affects Apache Tomcat 9.0.0.M5-9.0.36", "justification": "code_not_present" } }, { "id": "CVE-2020-13943", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:d9386d09-47f7-5502-87da-e45cb6be7c85", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-13943 does not affect version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-coyote. Version 9.0.50 is not vulnerable. Summary: Target repository already has the fix for CVE-2020-13943 applied. The maxConcurrentStreams check is correctly located in headersEnd() method, not in headersStart(). [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "code_not_present" } }, { "id": "CVE-2020-17527", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:364b56c4-de87-559c-b271-b54c5a0e30b1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-17527 affects version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2021-25122", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:3770f037-8632-5c21-a3e3-17b9c2838d7b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-25122 affects version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2022-42252", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:e773fd9e-c9aa-5f32-8a7a-a7ffcb1dfcd7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-42252 is fixed in version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2022-45143", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:02b68af5-e4d2-55a9-9259-0d763c3eb2e3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-45143 is fixed in version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-24998", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:d4305c0d-a4a2-5673-a6d5-526015b6d362", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-24998 is fixed in version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-28709", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:9da14de5-2d84-5163-9d7a-15b5148eedba", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-28709 is fixed in version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-34981", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:7f103ec0-66e4-5abb-9e05-e03a31aa71ba", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-34981 affects version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-42794", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:f4781868-7e9b-5409-a1fc-434d5ab08806", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-42794 does not affect version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 Apache Tomcat 9.0.50 is NOT affected by CVE-2023-42794. The target version (released June 28, 2021) predates the vulnerable versions (9.0.70-9.0.80) and already contains the finalize() method that prevents the vulnerability. The CVE describes a denial-of-service issue introduced by \"unreleased, in progress refactoring\" that removed the finalize() cleanup method in versions 9.0.70-9.0.80. Versio...", "justification": "code_not_present" } }, { "id": "CVE-2023-42795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:5e3c1a94-b6fa-5942-8b2f-bfdd8ff59660", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-42795 is fixed in version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-44487", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:b9958b3c-764d-5e9a-abd8-ead3f740a796", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-44487 is fixed in version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-45648", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:f534a5b5-c0f0-58ac-b070-d3583d18417e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-45648 is fixed in version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-46589", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:092eea5f-75cd-5ec1-b294-a2a7183ac475", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-46589 is fixed in version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-21733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:27dd31d6-289f-53f7-9730-db633abcff30", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-21733 affects version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-24549", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:dd029b0b-906c-540e-8917-2fbf31ca2f92", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-24549 is fixed in version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-34750", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:bb6776cb-7dc9-596c-b457-150c1cdf3070", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34750 is fixed in version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-38286", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:f902de5d-b337-5064-9501-f4088fe9f012", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38286 is fixed in version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-52317", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:c53c78d3-f2ee-54ef-83e1-59eac96b5af6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-52317 affects version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2025-31650", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:272cb598-e778-5abc-ba4c-0cd149e4f325", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-31650 does not affect version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-coyote. 9.0.50 predates HTTP/2 RFC 9218 PRIORITY_UPDATE frame support (added in 9.0.76). Advisory range per NVD/Snyk/GHSA is 9.0.76-9.0.102. Code inspection confirms: Http2Parser.processFramePriorityUpdate method and priority parsing in Stream.emitHeader do not exist in this baseline. Vulnerable code path is absent.", "justification": "code_not_present" } }, { "id": "CVE-2025-48989", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:1173b23b-9471-50e5-904d-8dc513e57f02", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48989 is fixed in version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2025-52434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:c9e2631d-c413-5f26-820d-7f1a4fbd38e0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-52434 is fixed in version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2025-53506", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:b02ff578-25f7-597e-819f-f105a0b183ec", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-53506 is fixed in version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2025-66614", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:63c753de-8c69-5bca-b8c2-6c36c227d078", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66614 is fixed in version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-24733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:efef2ae7-0aa9-54a1-bc90-c0236fb0672f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-24733 is fixed in version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-24734", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:cbd37e90-f4ef-5f6b-9b2e-fc9d64136784", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24734 affects version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-24880", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:4b33c339-9145-554a-a5af-3265af142312", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24880 affects version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-29129", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:06c24102-bfbd-531b-96fc-e61db06d7a03", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-29129 affects version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-32990", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:f076c241-649f-5b07-b3a5-648442922d9a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-32990 affects version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-41293", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:d8e877e8-5dee-5096-8a68-ed4c93677d48", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41293 affects version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-53434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:b6e37d49-b6d5-5557-a570-705a96886bf8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53434 affects version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-65637", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.50-tuxcare.16" } ], "bom-ref": "urn:uuid:b5e032a1-882e-5066-a299-4e7536145c9d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65637 affects version 9.0.50-tuxcare.16 of org.apache.tomcat:tomcat-coyote." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.50-tuxcare.16" } ] }