{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:c86a1041-0a42-50e7-a12d-84043ef965b5", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat-coyote", "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83-tuxcare.6", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83-tuxcare.6", "version": "9.0.83-tuxcare.6", "pedigree": { "ancestors": [ { "name": "tomcat-coyote", "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83", "type": "library", "group": "org.apache.tomcat", "version": "9.0.83" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-0095", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83-tuxcare.6" } ], "bom-ref": "urn:uuid:0761bbab-1c83-5a45-b6dd-dea3b400f9b4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0095 affects version 9.0.83-tuxcare.6 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2016-6816", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83-tuxcare.6" } ], "bom-ref": "urn:uuid:df1a0d1e-3cbd-548f-a29a-99fc8f696398", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-6816 affects version 9.0.83-tuxcare.6 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2017-5651", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83-tuxcare.6" } ], "bom-ref": "urn:uuid:fcf5d3e7-401e-5d0d-b347-a57474abacc8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-5651 affects version 9.0.83-tuxcare.6 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2019-0199", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83-tuxcare.6" } ], "bom-ref": "urn:uuid:5b38c332-e91c-5eb7-86fb-d5eeb185769e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-0199 affects version 9.0.83-tuxcare.6 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2020-13934", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83-tuxcare.6" } ], "bom-ref": "urn:uuid:65ea6ce0-18fd-5a79-a503-5707db02d0b2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-13934 does not affect version 9.0.83-tuxcare.6 of org.apache.tomcat:tomcat-coyote. CVE-2020-13934 is not present in Tomcat 9.0.83-tuxcare.5. The vulnerability affects Tomcat 9.0.0.M5 to 9.0.36 where h2c direct connections did not release the HTTP/1.1 processor after upgrading to HTTP/2, causing memory exhaustion. The upstream Apache fix (commit 172977f0 by Mark Thomas, released in 9.0.37) that adds release(processor) before creating the upgrade processor is already present in the target at AbstractProtocol.java lines 945-946. Since version 9.0.83 is well after the affected range and inherits the vendor fix from upstream, the target is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2020-13943", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83-tuxcare.6" } ], "bom-ref": "urn:uuid:b641db26-d353-5d60-9aee-f1cf986f4e2a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-13943 does not affect version 9.0.83-tuxcare.6 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 CVE-2020-13943 is NOT present in Apache Tomcat 9.0.83-tuxcare.5. The vulnerability affected Tomcat versions up to 9.0.37 and was fixed in 9.0.38 (July 2020) by upstream Apache. The target version 9.0.83 is based on the upstream Apache Tomcat 9.0.83 release (November 2023), which already contains the fix. The concurrent stream limit check has been correctly moved from headersStart() to headersEn...", "justification": "code_not_present" } }, { "id": "CVE-2020-17527", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83-tuxcare.6" } ], "bom-ref": "urn:uuid:6132b6ea-10b5-5e2a-9c70-195289c467b2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-17527 affects version 9.0.83-tuxcare.6 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2021-25122", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83-tuxcare.6" } ], "bom-ref": "urn:uuid:3c5deed6-41f5-56af-b9a0-ed6c67cea69a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-25122 affects version 9.0.83-tuxcare.6 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2022-42252", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83-tuxcare.6" } ], "bom-ref": "urn:uuid:ee5d35a9-157a-5936-b99e-29b06cf3f5b6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-42252 affects version 9.0.83-tuxcare.6 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-24998", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83-tuxcare.6" } ], "bom-ref": "urn:uuid:de800a79-2445-564e-b5a8-f71ae92f46ab", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-24998 affects version 9.0.83-tuxcare.6 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-28709", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83-tuxcare.6" } ], "bom-ref": "urn:uuid:6c1f1ceb-c162-5929-8af2-8dfcde01368b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-28709 affects version 9.0.83-tuxcare.6 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-34981", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83-tuxcare.6" } ], "bom-ref": "urn:uuid:ee267e84-1379-514c-be94-f1ae4f370771", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-34981 affects version 9.0.83-tuxcare.6 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-42794", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83-tuxcare.6" } ], "bom-ref": "urn:uuid:9ad30937-33ed-5f97-b7b0-d9a2afef1861", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-42794 does not affect version 9.0.83-tuxcare.6 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 CVE-2023-42794 is NOT present in Tomcat 9.0.83. The vulnerability affects Tomcat 9.0.70-9.0.80, where a missing finalize() method in DiskFileItem causes temporary uploaded files to persist indefinitely on Windows when applications fail to close streams, leading to disk exhaustion DoS. The fix (adding a finalize() method for automatic cleanup) was introduced in upstream Tomcat 9.0.81 via commit ...", "justification": "code_not_present" } }, { "id": "CVE-2023-44487", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83-tuxcare.6" } ], "bom-ref": "urn:uuid:2526b746-79b2-5118-af02-0d659ff6be55", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-44487 affects version 9.0.83-tuxcare.6 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-45648", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83-tuxcare.6" } ], "bom-ref": "urn:uuid:3dfe3369-7b07-5faa-a553-5ccc5090bf7a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-45648 does not affect version 9.0.83-tuxcare.6 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 The target Apache Tomcat 9.0.83-tuxcare.6 is NOT AFFECTED by CVE-2023-45648. The vulnerability involves improper parsing of HTTP trailer headers that could enable request smuggling. The upstream fix (commit 59583245639d8c42ae0009f4a4a70464d3ea70a0 by Mark Thomas) adds two critical validations: (1) trailer header names must be valid HTTP tokens using HttpParser.isToken(), and (2) trailer header ...", "justification": "code_not_present" } }, { "id": "CVE-2023-46589", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83-tuxcare.6" } ], "bom-ref": "urn:uuid:1aa0b477-00a5-53d0-b087-fa907b43663e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-46589 affects version 9.0.83-tuxcare.6 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-21733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83-tuxcare.6" } ], "bom-ref": "urn:uuid:81f13f11-2bc3-535b-975f-3bf36c8fb689", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-21733 affects version 9.0.83-tuxcare.6 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-24549", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83-tuxcare.6" } ], "bom-ref": "urn:uuid:fb79c161-1784-57d0-a880-a1726383f321", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-24549 is fixed in version 9.0.83-tuxcare.6 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-34750", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83-tuxcare.6" } ], "bom-ref": "urn:uuid:326a642e-404e-5c76-9b10-414b905429a4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34750 is fixed in version 9.0.83-tuxcare.6 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-38286", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83-tuxcare.6" } ], "bom-ref": "urn:uuid:0b37915e-caa0-5e5f-a5c9-7d3d08f61702", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38286 is fixed in version 9.0.83-tuxcare.6 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-52317", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83-tuxcare.6" } ], "bom-ref": "urn:uuid:e7405c0f-fa5c-5212-a92b-f7918091623e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-52317 affects version 9.0.83-tuxcare.6 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2025-31650", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83-tuxcare.6" } ], "bom-ref": "urn:uuid:fc29edff-f2b0-5d93-886b-cabaabc2c41b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-31650 is fixed in version 9.0.83-tuxcare.6 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2025-48989", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83-tuxcare.6" } ], "bom-ref": "urn:uuid:455e7d6a-e1ed-573d-acfa-1491807ebf74", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48989 is fixed in version 9.0.83-tuxcare.6 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2025-52434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83-tuxcare.6" } ], "bom-ref": "urn:uuid:5a83d73a-8f09-54c8-987a-79df2609a46f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-52434 is fixed in version 9.0.83-tuxcare.6 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2025-53506", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83-tuxcare.6" } ], "bom-ref": "urn:uuid:acd6ff20-94ed-5bed-adc9-e353adfbcf9b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-53506 is fixed in version 9.0.83-tuxcare.6 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2025-66614", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83-tuxcare.6" } ], "bom-ref": "urn:uuid:e47d938a-4f35-5150-b277-deff3344f374", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66614 is fixed in version 9.0.83-tuxcare.6 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-24733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83-tuxcare.6" } ], "bom-ref": "urn:uuid:b0d2f5af-f82e-54b5-bafe-519a940edc77", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-24733 is fixed in version 9.0.83-tuxcare.6 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-24734", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83-tuxcare.6" } ], "bom-ref": "urn:uuid:4da61c06-fb9a-50f1-8c87-e33cf3921bd3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24734 affects version 9.0.83-tuxcare.6 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-24880", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83-tuxcare.6" } ], "bom-ref": "urn:uuid:e2910a23-2bbc-5ad8-80a0-1695f39ada1d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24880 affects version 9.0.83-tuxcare.6 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-29129", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83-tuxcare.6" } ], "bom-ref": "urn:uuid:539cabd9-f755-5af8-877d-ac3724983a10", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-29129 affects version 9.0.83-tuxcare.6 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-32990", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83-tuxcare.6" } ], "bom-ref": "urn:uuid:c37dfa11-916c-5318-88c9-830636cf1bfc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-32990 affects version 9.0.83-tuxcare.6 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-41293", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83-tuxcare.6" } ], "bom-ref": "urn:uuid:03f5f468-161d-5fec-809e-c70f3c4ab9ef", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41293 affects version 9.0.83-tuxcare.6 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-65637", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83-tuxcare.6" } ], "bom-ref": "urn:uuid:eda16b1a-b5e3-5387-bf6d-a2778ab7292a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65637 affects version 9.0.83-tuxcare.6 of org.apache.tomcat:tomcat-coyote." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.83-tuxcare.6" } ] }