{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:d64cc688-c5d3-5abf-958e-ed3e5fb4a536",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "tomcat-jasper",
      "purl": "pkg:maven/org.apache.tomcat/tomcat-jasper@9.0.39-tuxcare.1",
      "type": "library",
      "group": "org.apache.tomcat",
      "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@9.0.39-tuxcare.1",
      "version": "9.0.39-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "tomcat-jasper",
            "purl": "pkg:maven/org.apache.tomcat/tomcat-jasper@9.0.39",
            "type": "library",
            "group": "org.apache.tomcat",
            "version": "9.0.39"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2016-5018",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@9.0.39-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:3c228697-ae40-5c0f-97fd-5a6d7efacac1",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2016-5018 affects version 9.0.39-tuxcare.1 of org.apache.tomcat:tomcat-jasper."
      }
    },
    {
      "id": "CVE-2022-45143",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@9.0.39-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:f689454e-f627-5d0a-8027-b53170ea63d7",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-45143 does not affect version 9.0.39-tuxcare.1 of org.apache.tomcat:tomcat-jasper. Apache Tomcat 9.0.39 is not affected by CVE-2022-45143. The vulnerable component (JsonErrorReportValve) does not exist in this version. JsonErrorReportValve was first introduced in version 9.0.40 (commit 295709303f), which is one version after the target. The CVE's stated affected range (9.0.40 to 9.0.68) correctly excludes 9.0.39. This is a Rule 5 Type A1 case: the component that receives the malicious input is absent from the codebase.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-42795",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@9.0.39-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:b9a2f392-d24d-55a1-9f6f-3765734b8a43",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-42795 affects version 9.0.39-tuxcare.1 of org.apache.tomcat:tomcat-jasper, and is fixed in 9.0.39-tuxcare.2."
      }
    },
    {
      "id": "CVE-2026-53434",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@9.0.39-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:12e285bf-66d1-5c9d-a8c3-d753e571f913",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-53434 affects version 9.0.39-tuxcare.1 of org.apache.tomcat:tomcat-jasper."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@9.0.39-tuxcare.1"
    }
  ]
}