{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:5ae7625f-8806-5905-b96f-548d386c5eae",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "tomcat-jasper",
      "purl": "pkg:maven/org.apache.tomcat/tomcat-jasper@10.1.18-tuxcare.9",
      "type": "library",
      "group": "org.apache.tomcat",
      "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@10.1.18-tuxcare.9",
      "version": "10.1.18-tuxcare.9",
      "pedigree": {
        "ancestors": [
          {
            "name": "tomcat-jasper",
            "purl": "pkg:maven/org.apache.tomcat/tomcat-jasper@10.1.18",
            "type": "library",
            "group": "org.apache.tomcat",
            "version": "10.1.18"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2016-5018",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@10.1.18-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:625fde4c-35fe-5d16-b651-49a3449ea961",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2016-5018 affects version 10.1.18-tuxcare.9 of org.apache.tomcat:tomcat-jasper."
      }
    },
    {
      "id": "CVE-2022-45143",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@10.1.18-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:a1473f38-c700-5552-a478-d4101a9c1903",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-45143 affects version 10.1.18-tuxcare.9 of org.apache.tomcat:tomcat-jasper."
      }
    },
    {
      "id": "CVE-2023-42795",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@10.1.18-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:84e7591a-2b24-5ccb-8c2a-0063553bfe2a",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-42795 does not affect version 10.1.18-tuxcare.9 of org.apache.tomcat:tomcat-jasper. not_affected \u2014 The target repository (Apache Tomcat 10.1.18-tuxcare.9) is NOT affected by CVE-2023-42795. The fix for this incomplete cleanup vulnerability was already present in the upstream Apache Tomcat 10.1.18 release, which TuxCare onboarded. All vulnerable recycle() methods identified in the vendor patches have been hardened with proper exception handling to prevent information leakage between requests.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-53434",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@10.1.18-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:fc72ce09-d165-5898-91c5-da4ad2691dc7",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-53434 affects version 10.1.18-tuxcare.9 of org.apache.tomcat:tomcat-jasper."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@10.1.18-tuxcare.9"
    }
  ]
}