{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:25c1b8f4-f8d1-5fdd-a457-47df43ef63b2",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "tomcat-jasper",
      "purl": "pkg:maven/org.apache.tomcat/tomcat-jasper@10.1.55-tuxcare.1",
      "type": "library",
      "group": "org.apache.tomcat",
      "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@10.1.55-tuxcare.1",
      "version": "10.1.55-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "tomcat-jasper",
            "purl": "pkg:maven/org.apache.tomcat/tomcat-jasper@10.1.55",
            "type": "library",
            "group": "org.apache.tomcat",
            "version": "10.1.55"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2016-5018",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@10.1.55-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:cbee0c4d-f540-5010-99df-1f7b9fdf150d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2016-5018 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-jasper."
      }
    },
    {
      "id": "CVE-2022-45143",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@10.1.55-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:8735e5c3-3133-50ed-aff1-4cbdfdb46c74",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-45143 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-jasper."
      }
    },
    {
      "id": "CVE-2023-42795",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@10.1.55-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:1f039c4d-2d2e-5324-af31-297d0dac47c7",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-42795 does not affect version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-jasper. not_affected \u2014 CVE-2023-42795 (Incomplete Cleanup vulnerability) is not present in Tomcat 10.1.55. The upstream fix by Mark Thomas (commit 9375d67106) was included in the Apache Tomcat 10.1.55 release that TuxCare onboarded. All required defensive changes are present: try-catch blocks in recycle() methods for Request.java, ApplicationHttpRequest.java, B2CConverter.java, and C2BConverter.java ensure cleanup co...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-53434",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@10.1.55-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:90483e8a-92b7-5dad-92f7-7ec24739047e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-53434 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-jasper."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@10.1.55-tuxcare.1"
    }
  ]
}