{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:fd3e97d1-35e5-5dc9-8cbd-aa76ab7a22c8", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat-storeconfig", "purl": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.55-tuxcare.1", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.55-tuxcare.1", "version": "10.1.55-tuxcare.1", "pedigree": { "ancestors": [ { "name": "tomcat-storeconfig", "purl": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.55", "type": "library", "group": "org.apache.tomcat", "version": "10.1.55" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2017-12617", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:e9e72f07-e30b-5cdb-8023-c5eccc7e188a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-12617 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2017-5648", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:941c1eed-2848-55a6-8ec5-a77eefc47ae2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-5648 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2019-0199", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:39554a7d-677d-5e68-991d-d125c3d8f1c0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-0199 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2019-0221", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:55b5237d-73a3-524c-8167-5d3073ea25a0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-0221 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2020-13934", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:28507040-2ed3-5b06-839a-430d66b0c726", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-13934 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2020-13943", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:247285bc-c47e-5ce9-a1e8-164350588c28", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-13943 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2020-17527", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:cee3915d-ee18-593f-a9af-95a6f66db5ee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-17527 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2020-9484", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:9a38704b-e25d-528e-8e4e-98c03b530175", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-9484 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2022-42252", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:f459708b-bbc0-5e85-89bd-70b6d3170c99", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-42252 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2022-45143", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:4e74f106-a1dc-5ce0-97a8-c8c35d2d01aa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-45143 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2023-24998", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:993af7c7-700b-5f5e-be86-a4ea6ac6a4df", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-24998 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2023-28708", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:c37789ef-bafc-5a94-8b9f-2152ffb69b6a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-28708 does not affect version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig. not_affected \u2014 Target version 10.1.55 is not affected by CVE-2023-28708. The vulnerability (missing Secure attribute on session cookies when RemoteIpFilter processes X-Forwarded-Proto: https) was fixed in upstream Tomcat commit f509bbf31f (Feb 2023) by lihan@apache.org. This fix was already present in upstream release 10.1.55 when TuxCare onboarded it (Sep 2026). The CVE affected versions 10.1.0-M1 to 10.1.5;...", "justification": "code_not_present" } }, { "id": "CVE-2023-41080", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:f8cffb73-7a9b-5e04-85ae-3f8944714593", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-41080 does not affect version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig. not_affected \u2014 CVE-2023-41080 (Open Redirect via protocol-relative URLs in FORM authentication) is NOT present in this target. The fix that prevents protocol-relative redirects by removing leading forward slashes from redirect URLs was already included in the upstream Apache Tomcat 10.1.13 release (commit bb4624a9f3e by Mark Thomas, 2023-08-22). Since TuxCare onboarded version 10.1.55 (much later than 10.1.13...", "justification": "code_not_present" } }, { "id": "CVE-2023-42794", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:839c6e7f-e30e-588a-8980-b6d02337f989", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-42794 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2023-42795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:8ea14779-7c6b-58dc-ba7d-6d8b57186313", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-42795 does not affect version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig. not_affected \u2014 CVE-2023-42795 (Incomplete Cleanup vulnerability) is not present in Tomcat 10.1.55. The upstream fix by Mark Thomas (commit 9375d67106) was included in the Apache Tomcat 10.1.55 release that TuxCare onboarded. All required defensive changes are present: try-catch blocks in recycle() methods for Request.java, ApplicationHttpRequest.java, B2CConverter.java, and C2BConverter.java ensure cleanup co...", "justification": "code_not_present" } }, { "id": "CVE-2023-44487", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:c39e3217-a19f-5d09-b83c-69b9570dac73", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-44487 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2023-45648", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:c90f4ac1-6ee0-5160-9a33-f744c2b96104", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-45648 does not affect version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig. not_affected \u2014 CVE-2023-45648 is NOT present in Tomcat 10.1.55. The vulnerability (improper HTTP trailer header parsing allowing request smuggling) was fixed in the upstream release before TuxCare onboarded it. Tomcat 10.1.55 uses HttpHeaderParser class for trailer parsing, which includes built-in validation that rejects non-token characters in header names (line 141-148) and control characters except tab in ...", "justification": "code_not_present" } }, { "id": "CVE-2023-46589", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:f4b34320-e6aa-59ca-8744-77997c50e736", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-46589 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2024-21733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:95776092-1b5f-5b8a-9411-67593ea27147", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-21733 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2024-24549", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:eca080fc-4c0c-5b16-8605-f2633add01bb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-24549 does not affect version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig. The target Apache Tomcat 10.1.55 is NOT vulnerable to CVE-2024-24549. The vulnerability was fixed in upstream Tomcat 10.1.19 (released 2024-02-19), and version 10.1.55 includes this fix. The fix moves HTTP/2 header validation to occur after each frame (HEADERS and CONTINUATION) rather than delaying until all headers are complete, preventing resource exhaustion from oversized headers. The fix commit (d07c82194e by markt@apache.org) is present in the target's git history and was part of the upstream release onboarded by TuxCare.", "justification": "code_not_present" } }, { "id": "CVE-2024-34750", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:cce0d04a-f792-5f67-9e06-24f3a600165d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-34750 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2024-38286", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:bba4bd7c-dd82-5308-8afd-0776067f362a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38286 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2024-50379", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:05abc5db-3244-5645-9fc7-6013adb5bac5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-50379 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2024-52316", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:ed60b8b9-66bd-5dce-a502-c52dd62a4531", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-52316 does not affect version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig. CVE-2024-52316 affects Apache Tomcat 10.1.0-M1 through 10.1.30. The target is version 10.1.55, which already contains the upstream fix authored by Mark Thomas in commit acc2f01395. The fix adds explicit HTTP 500 status setting when Jakarta Authentication fails with an exception, preventing authentication bypass. This fix shipped in upstream release 10.1.31 and was included when TuxCare onboarded version 10.1.55.", "justification": "code_not_present" } }, { "id": "CVE-2024-56337", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:c1934f3f-085b-5fbe-80e3-49280386feea", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-56337 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2025-24813", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:e19fb7c3-d310-5519-ba42-f93831fc8885", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-24813 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2025-31650", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:6b720186-f165-5d6d-84dd-8d175c62c0d1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31650 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2025-31651", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:e55a1cf0-b024-5545-a2c1-050cb2311d5b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31651 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2025-46701", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:b47ba695-e07e-58ff-a088-a797e94fb7d8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-46701 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2025-48988", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:a02fcb91-b3fe-5b80-805c-c04cedf0606e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-48988 does not affect version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig. CVE-2025-48988 affects Apache Tomcat 10.1.0-M1 through 10.1.41 and was fixed in 10.1.42. The target repository is version 10.1.55, which already contains the upstream fix (commit cdde8e655b by Apache developer Mark Thomas). The fix adds two resource limits for multipart/form-data requests: maxPartCount (default 50) and maxPartHeaderSize (default 512 bytes), preventing unbounded resource allocation. These limits are enforced in Request.parseParts() via Apache Commons FileUpload. The fix was part of the upstream Apache Tomcat 10.1.55 release that TuxCare onboarded, not a separate TuxCare backport.", "justification": "code_not_present" } }, { "id": "CVE-2025-48989", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:1e12db0a-b4e4-5fe2-88cf-45be402690ee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-48989 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2025-49124", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:38f78ed5-6bcb-5c54-8715-72337b24128a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49124 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2025-49125", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:b782bbe3-7be1-5794-b766-929574815baa", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-49125 does not affect version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig. Apache Tomcat 10.1.55 is not affected by CVE-2025-49125. The vulnerability was fixed in upstream version 10.1.42, and version 10.1.55 already contains the fix. The fix introduces an isPathMounted() method that validates the character following the mount point prefix is either end-of-string or a '/' separator, preventing prefix-collision attacks on PreResources and PostResources. This is an upstream fix authored by Mark Thomas (markt@apache.org) that shipped in the upstream release onboarded by TuxCare.", "justification": "code_not_present" } }, { "id": "CVE-2025-52434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:7707fd36-a07f-572e-9cc6-47b59bc9a63a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-52434 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2025-52520", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:b008269a-3137-5d65-b028-278a083b9d02", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-52520 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2025-53506", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:62ed2817-ef36-5309-85f3-7ccc91dac886", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-53506 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2025-55668", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:15600fdf-8be8-5ab5-b190-35dee2fe1b0b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-55668 does not affect version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig. not_affected \u2014 Target version 10.1.55 is not affected by CVE-2025-55668. The session fixation vulnerability in the rewrite valve was fixed in upstream Apache Tomcat 10.1.42, and version 10.1.55 ships with this fix already applied. Both critical defense mechanisms are present: (1) redirect URLs are properly encoded with session IDs via response.encodeRedirectURL() at line 474, and (2) session information is re...", "justification": "code_not_present" } }, { "id": "CVE-2025-55752", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:5743d867-96a0-5ccf-b857-dbde8f8265c1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55752 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2025-55754", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:86ed8e73-eb5b-50f9-a392-25c108262607", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55754 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2025-61795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:643c29d4-5b5a-54fb-a9a9-6b4ec2541fdd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-61795 does not affect version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig. not_affected \u2014 Target version 10.1.55 already contains the upstream fix for CVE-2025-61795. The vulnerable pattern (missing immediate cleanup of temporary files after failed multipart uploads) is not present. The fix (commit af6e9181 by Mark Thomas) was shipped in Apache Tomcat's upstream 10.1.55 release, which TuxCare subsequently onboarded. The fix adds explicit `item.delete()` cleanup in a finally block wh...", "justification": "code_not_present" } }, { "id": "CVE-2025-66614", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:81c8daf0-1c0f-5d0c-a13d-c44d6f79d00a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66614 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2026-24733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:178e50e4-8d13-56ac-a783-9acc9e090b65", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-24733 does not affect version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig. not_affected \u2014 Apache Tomcat 10.1.55 is not affected by CVE-2026-24733. The CVE describes a vulnerability where HTTP/0.9 requests were not limited to the GET method, allowing security constraint bypass. However, the fix was already present in upstream Apache Tomcat 10.1.55 (released after the fixed version 10.1.50). The defense code is present at Http11Processor.java:612-616, which rejects HTTP/0.9 requests w...", "justification": "code_not_present" } }, { "id": "CVE-2026-24734", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:a1032686-f7bd-5550-b209-048c7c607a64", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24734 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2026-24880", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:bc813b78-8484-578f-82f9-e51c7d53bb64", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-24880 does not affect version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig. CVE-2026-24880 (HTTP Request Smuggling via invalid chunk extension) is NOT present in Tomcat 10.1.55. The vulnerability required proper validation of chunk extension syntax to prevent inconsistent interpretation between HTTP processors. The upstream fix (commits f07df938d0 and 1e71441a15 by Mark Thomas) introduced a ChunkExtension.parse() state machine parser that validates chunk extensions according to RFC specifications. This fix was already included in the upstream Apache Tomcat 10.1.55 release, which TuxCare subsequently onboarded. The target code contains the complete fix: ChunkExtension.java with the state machine parser exists, and ChunkedInputFilter.java correctly uses ChunkExtension.parse() to validate all chunk extensions in both parseChunkHeader() and skipChunkHeader() methods.", "justification": "code_not_present" } }, { "id": "CVE-2026-25854", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:c3edc78c-ed38-5e96-a21f-1c6c197dc330", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-25854 does not affect version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig. not_affected \u2014 The target repository (Apache Tomcat 10.1.55) is NOT AFFECTED by CVE-2026-25854. The vulnerability involves an open redirect via LoadBalancerDrainingValve when multiple leading slashes in URIs create protocol-relative URLs. Both required fixes are present in the target: (1) collapseLeadingSlashes() sanitizes URIs at line 211, and (2) sendRedirect() provides validated redirects at line 226. Thes...", "justification": "code_not_present" } }, { "id": "CVE-2026-29146", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:908ff0bb-0f04-5510-ba18-4004f6c92f8d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-29146 does not affect version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig. Target version 10.1.55 is not affected by CVE-2026-29146. The CVE affects Apache Tomcat versions through 10.1.52, with fixes shipped in 10.1.53+. The target contains upstream fixes (commits 607ebc0fa5 and 55f3eb9148 by markt@apache.org) that mitigate the padding oracle vulnerability through improved error handling and algorithm validation. The error handling ensures all decryption failures are handled uniformly (message dropped, error logged), preventing attackers from distinguishing padding errors from other decryption failures. Algorithm validation warns users that CBC/PKCS5Padding is not recommended and suggests switching to AES/GCM/NoPadding. Both fixes were present in the upstream 10.1.55 release before TuxCare onboarded it.", "justification": "code_not_present" } }, { "id": "CVE-2026-34483", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:a48db699-b78f-5e5d-8e17-e7f4811d3d42", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34483 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2026-34487", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:06ae4131-b560-58c4-97b8-d410f8a1ad18", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34487 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2026-41284", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:c9af9ddf-9d0b-5c42-aa41-7a4cba7ecc88", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41284 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2026-41293", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:89aa86d3-ae09-54ae-8671-b7a43385adf8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41293 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2026-42498", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:50e88207-e1dc-5671-b2f5-3d85eaef9d78", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42498 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2026-43512", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:c0fc1904-4f7f-59fc-830f-b28157e24279", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43512 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2026-43513", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:4222f162-8698-5d7d-8d72-7f80ddf28afd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43513 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2026-43514", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:d3d26d60-fdd6-5068-b949-bab2036442be", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-43514 does not affect version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig. not_affected \u2014 CVE-2026-43514 (AJP secret timing attack) is NOT present in the target. The vulnerable non-constant-time secret comparison was replaced with constant-time comparison in upstream Apache Tomcat 10.1.55. The fix (commit a102a2a157 by markt@apache.org) shipped in the upstream release before TuxCare onboarded it. The target code at java/org/apache/coyote/ajp/AjpProcessor.java:840 uses ConstantTime.e...", "justification": "code_not_present" } }, { "id": "CVE-2026-43515", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:4f0ea9a7-7cd4-5705-9eda-2995a46dc150", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43515 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2026-53434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:0e19eb40-993a-5a1c-893a-7c971420dfcc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53434 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2026-65182", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:8b98e449-3c0e-575d-a395-18d7d54c33d9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65182 is fixed in version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2026-65637", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:6ab99106-48d8-500f-a3ab-3644e159ba8d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65637 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2026-65905", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:60b33726-c174-5484-a006-f7969f7e4134", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65905 is fixed in version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2026-68525", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.55-tuxcare.1" } ], "bom-ref": "urn:uuid:9f7cb4a5-dd8b-56d4-9a21-8822327b7355", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68525 is fixed in version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@10.1.55-tuxcare.1" } ] }