{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:fea8561e-688e-5ce9-9837-a8b947deab9f", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat-jasper", "purl": "pkg:maven/org.apache.tomcat/tomcat-jasper@8.5.78-tuxcare.3", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@8.5.78-tuxcare.3", "version": "8.5.78-tuxcare.3", "pedigree": { "ancestors": [ { "name": "tomcat-jasper", "purl": "pkg:maven/org.apache.tomcat/tomcat-jasper@8.5.78", "type": "library", "group": "org.apache.tomcat", "version": "8.5.78" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-0763", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@8.5.78-tuxcare.3" } ], "bom-ref": "urn:uuid:db81b132-569d-56ff-8187-70145b8b8870", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-0763 does not affect version 8.5.78-tuxcare.3 of org.apache.tomcat:tomcat-jasper. not_affected \u2014 CVE-2016-0763 is NOT present in Tomcat 8.5.78. The vulnerability affects the setGlobalContext method in ResourceLinkFactory.java, which in vulnerable versions lacks authorization checks, allowing untrusted web applications to replace the global JNDI context and access arbitrary application data or cause DoS. The fix (commit bc8717f41a by upstream Apache developer kkolinko@apache.org) adds a Sec...", "justification": "code_not_present" } }, { "id": "CVE-2016-5018", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@8.5.78-tuxcare.3" } ], "bom-ref": "urn:uuid:49354580-62a6-5344-8c54-54c046c7a091", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-5018 does not affect version 8.5.78-tuxcare.3 of org.apache.tomcat:tomcat-jasper. Apache Tomcat 8.5.78 is not affected by CVE-2016-5018. The vulnerability involved a SecurityManager bypass via the JspRuntimeLibrary.introspecthelper() method, which executed bean introspection with elevated privileges using AccessController.doPrivileged(). The fix was applied by Apache upstream in commit 648122fef8 (Aug 2, 2016) and was already present in version 8.5.78 when TuxCare onboarded it (commit fb98844404, Sep 20, 2026). The vulnerable code pattern (PrivilegedIntrospectHelper class and doPrivileged wrapper) is not present in the target.", "justification": "code_not_present" } }, { "id": "CVE-2016-6817", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@8.5.78-tuxcare.3" } ], "bom-ref": "urn:uuid:d99a18e7-bc06-5df2-9671-0c6f770c3da1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-6817 does not affect version 8.5.78-tuxcare.3 of org.apache.tomcat:tomcat-jasper. CVE-2016-6817 (HTTP/2 header parser infinite loop) is NOT present in Apache Tomcat 8.5.78. The target version includes the upstream fix from commit 85c63227ed, authored by Mark Thomas (markt@apache.org), which shipped in Tomcat 8.5.7. The fix dynamically expands the header read buffer when capacity is exhausted, preventing the infinite loop that occurred when headers exceeded the fixed 1024-byte buffer. The vulnerable pattern (fixed-size buffer causing infinite loop when remaining() == 0 and payloadSize > 0) does not exist in the target code.", "justification": "code_not_present" } }, { "id": "CVE-2016-8747", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@8.5.78-tuxcare.3" } ], "bom-ref": "urn:uuid:5f41f863-d455-5922-91db-1053f0da1190", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-8747 does not affect version 8.5.78-tuxcare.3 of org.apache.tomcat:tomcat-jasper. Apache Tomcat 8.5.78 is NOT vulnerable to CVE-2016-8747. The vulnerability affected versions 8.5.7-8.5.9 (and 9.0.0.M11-M15) due to incorrect ByteBuffer state management in Http11InputBuffer.nextRequest() that could allow cross-request information disclosure on persistent HTTP connections. The fix (commit 9601a937ff by Mark Thomas, December 2016) was applied upstream in Tomcat 8.5.10 and is present in the target's 8.5.78 release. The vulnerable pattern is not present; the code correctly calls byteBuffer.flip() after compact() and properly resets buffer state between requests.", "justification": "code_not_present" } }, { "id": "CVE-2017-5650", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@8.5.78-tuxcare.3" } ], "bom-ref": "urn:uuid:9b8df6c6-7bf1-5840-beb5-a14ce0c28793", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-5650 does not affect version 8.5.78-tuxcare.3 of org.apache.tomcat:tomcat-jasper. Apache Tomcat 8.5.78 is not affected by CVE-2017-5650. The vulnerability (HTTP/2 GOAWAY frames not closing streams waiting for WINDOW_UPDATE, causing thread exhaustion) was fixed in upstream commit 51eba9b70c by Mark Thomas (markt@apache.org). This fix was already present in the upstream release 8.5.78 that TuxCare onboarded, as confirmed by the fix commit being an ancestor of the first TuxCare commit fb98844404.", "justification": "code_not_present" } }, { "id": "CVE-2017-7675", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@8.5.78-tuxcare.3" } ], "bom-ref": "urn:uuid:2b87ef99-7678-5410-b870-45aaa6a21ec4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-7675 does not affect version 8.5.78-tuxcare.3 of org.apache.tomcat:tomcat-jasper. Apache Tomcat 8.5.78 is NOT affected by CVE-2017-7675. The vulnerability (bypassing security constraints via path parameter stripping in HTTP/2 requests) was fixed in upstream Apache Tomcat by commit dacb030b85 on May 24, 2017. This fix was already present in the upstream Apache Tomcat 8.5.78 release that TuxCare onboarded in September 2026. The fix changes HTTP/2 `:path` header processing in Stream.java to set the URI as bytes (preserving path parameters) instead of as String (which stripped them), ensuring downstream security checks receive the complete path.", "justification": "code_not_present" } }, { "id": "CVE-2022-45143", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@8.5.78-tuxcare.3" } ], "bom-ref": "urn:uuid:5a5fd833-d8a2-501a-bd4e-dcfd4aa3e8f9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-45143 does not affect version 8.5.78-tuxcare.3 of org.apache.tomcat:tomcat-jasper. CVE-2022-45143 affects JsonErrorReportValve, which does not exist in Tomcat 8.5.78. The vulnerability involves missing JSON escaping in type/message/description fields. The target version only has ErrorReportValve, which generates HTML error reports with proper HTML escaping (Escape.htmlElementContent). JsonErrorReportValve was introduced upstream on 2020-10-14 in versions 8.5.83+, 9.0.40+, and 10.1.0+, never backported to 8.5.78. The attack chain (user-provided error data \u2192 manipulated JSON output) cannot complete because JSON error reporting does not exist in the target. Verdict: not_affected per Rule 5 Type A2 (input received but chain to Goal broken by missing JSON generation).", "justification": "code_not_reachable" } }, { "id": "CVE-2023-42795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@8.5.78-tuxcare.3" } ], "bom-ref": "urn:uuid:980b1d00-23c8-5781-8f4d-e87177db4f13", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-42795 affects version 8.5.78-tuxcare.3 of org.apache.tomcat:tomcat-jasper." } }, { "id": "CVE-2026-53434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@8.5.78-tuxcare.3" } ], "bom-ref": "urn:uuid:bdba8dc0-7f0d-59f0-9a4f-03963a111fbf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53434 affects version 8.5.78-tuxcare.3 of org.apache.tomcat:tomcat-jasper." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@8.5.78-tuxcare.3" } ] }