{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:1af1e0c7-6041-5bf1-b8aa-d5396691415c",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "tomcat-jasper",
      "purl": "pkg:maven/org.apache.tomcat/tomcat-jasper@8.5.78-tuxcare.2",
      "type": "library",
      "group": "org.apache.tomcat",
      "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@8.5.78-tuxcare.2",
      "version": "8.5.78-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "tomcat-jasper",
            "purl": "pkg:maven/org.apache.tomcat/tomcat-jasper@8.5.78",
            "type": "library",
            "group": "org.apache.tomcat",
            "version": "8.5.78"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2016-5018",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@8.5.78-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:2f7c598d-fcc6-53aa-b07e-d129d188b434",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-5018 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-jasper. Apache Tomcat 8.5.78 is not affected by CVE-2016-5018. The vulnerability involved a SecurityManager bypass via the JspRuntimeLibrary.introspecthelper() method, which executed bean introspection with elevated privileges using AccessController.doPrivileged(). The fix was applied by Apache upstream in commit 648122fef8 (Aug 2, 2016) and was already present in version 8.5.78 when TuxCare onboarded it (commit fb98844404, Sep 20, 2026). The vulnerable code pattern (PrivilegedIntrospectHelper class and doPrivileged wrapper) is not present in the target.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-45143",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@8.5.78-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:697a5da7-a768-520b-9744-7b0f9a766cc0",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-45143 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-jasper. CVE-2022-45143 affects JsonErrorReportValve, which does not exist in Tomcat 8.5.78. The vulnerability involves missing JSON escaping in type/message/description fields. The target version only has ErrorReportValve, which generates HTML error reports with proper HTML escaping (Escape.htmlElementContent). JsonErrorReportValve was introduced upstream on 2020-10-14 in versions 8.5.83+, 9.0.40+, and 10.1.0+, never backported to 8.5.78. The attack chain (user-provided error data \u2192 manipulated JSON output) cannot complete because JSON error reporting does not exist in the target. Verdict: not_affected per Rule 5 Type A2 (input received but chain to Goal broken by missing JSON generation).",
        "justification": "code_not_reachable"
      }
    },
    {
      "id": "CVE-2023-42795",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@8.5.78-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:fcbb8918-1662-5f37-bd65-424ae173f193",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-42795 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-jasper."
      }
    },
    {
      "id": "CVE-2026-53434",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@8.5.78-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:6124dcb9-623a-5435-8101-ee576cfab4d1",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-53434 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-jasper."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@8.5.78-tuxcare.2"
    }
  ]
}