{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:f48e4dd6-f80f-5468-99e1-04c974d1b5ef",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "tomcat-juli",
      "purl": "pkg:maven/org.apache.tomcat/tomcat-juli@8.5.78-tuxcare.2",
      "type": "library",
      "group": "org.apache.tomcat",
      "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-juli@8.5.78-tuxcare.2",
      "version": "8.5.78-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "tomcat-juli",
            "purl": "pkg:maven/org.apache.tomcat/tomcat-juli@8.5.78",
            "type": "library",
            "group": "org.apache.tomcat",
            "version": "8.5.78"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2016-0763",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-juli@8.5.78-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:38b6e490-8b07-5bd9-bb95-0a4f56e314a9",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-0763 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-juli. not_affected \u2014 CVE-2016-0763 is NOT present in Tomcat 8.5.78. The vulnerability affects the setGlobalContext method in ResourceLinkFactory.java, which in vulnerable versions lacks authorization checks, allowing untrusted web applications to replace the global JNDI context and access arbitrary application data or cause DoS. The fix (commit bc8717f41a by upstream Apache developer kkolinko@apache.org) adds a Sec...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-6817",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-juli@8.5.78-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:5a6b7647-7091-5e77-8d1b-b085f84dc4bc",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-6817 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-juli. CVE-2016-6817 (HTTP/2 header parser infinite loop) is NOT present in Apache Tomcat 8.5.78. The target version includes the upstream fix from commit 85c63227ed, authored by Mark Thomas (markt@apache.org), which shipped in Tomcat 8.5.7. The fix dynamically expands the header read buffer when capacity is exhausted, preventing the infinite loop that occurred when headers exceeded the fixed 1024-byte buffer. The vulnerable pattern (fixed-size buffer causing infinite loop when remaining() == 0 and payloadSize > 0) does not exist in the target code.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-8747",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-juli@8.5.78-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:924d4bbe-e306-5d36-9869-e856091b4ff0",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-8747 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-juli. Apache Tomcat 8.5.78 is NOT vulnerable to CVE-2016-8747. The vulnerability affected versions 8.5.7-8.5.9 (and 9.0.0.M11-M15) due to incorrect ByteBuffer state management in Http11InputBuffer.nextRequest() that could allow cross-request information disclosure on persistent HTTP connections. The fix (commit 9601a937ff by Mark Thomas, December 2016) was applied upstream in Tomcat 8.5.10 and is present in the target's 8.5.78 release. The vulnerable pattern is not present; the code correctly calls byteBuffer.flip() after compact() and properly resets buffer state between requests.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-5650",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-juli@8.5.78-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:42083e9a-0fb6-565d-b695-d7b97afeafef",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-5650 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-juli. Apache Tomcat 8.5.78 is not affected by CVE-2017-5650. The vulnerability (HTTP/2 GOAWAY frames not closing streams waiting for WINDOW_UPDATE, causing thread exhaustion) was fixed in upstream commit 51eba9b70c by Mark Thomas (markt@apache.org). This fix was already present in the upstream release 8.5.78 that TuxCare onboarded, as confirmed by the fix commit being an ancestor of the first TuxCare commit fb98844404.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-7675",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-juli@8.5.78-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:91f14110-1ae6-5624-9220-61421b54f5c7",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-7675 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-juli. Apache Tomcat 8.5.78 is NOT affected by CVE-2017-7675. The vulnerability (bypassing security constraints via path parameter stripping in HTTP/2 requests) was fixed in upstream Apache Tomcat by commit dacb030b85 on May 24, 2017. This fix was already present in the upstream Apache Tomcat 8.5.78 release that TuxCare onboarded in September 2026. The fix changes HTTP/2 `:path` header processing in Stream.java to set the URI as bytes (preserving path parameters) instead of as String (which stripped them), ensuring downstream security checks receive the complete path.",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.tomcat/tomcat-juli@8.5.78-tuxcare.2"
    }
  ]
}