{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:7b8a8445-2740-53d3-a97d-3f2143097f1a", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat-storeconfig", "purl": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.78-tuxcare.2", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.78-tuxcare.2", "version": "8.5.78-tuxcare.2", "pedigree": { "ancestors": [ { "name": "tomcat-storeconfig", "purl": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.78", "type": "library", "group": "org.apache.tomcat", "version": "8.5.78" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-0763", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:c34e2651-9785-5f10-92b2-228c334284b9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-0763 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-storeconfig. not_affected \u2014 CVE-2016-0763 is NOT present in Tomcat 8.5.78. The vulnerability affects the setGlobalContext method in ResourceLinkFactory.java, which in vulnerable versions lacks authorization checks, allowing untrusted web applications to replace the global JNDI context and access arbitrary application data or cause DoS. The fix (commit bc8717f41a by upstream Apache developer kkolinko@apache.org) adds a Sec...", "justification": "code_not_present" } }, { "id": "CVE-2016-6817", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:a6a9856c-91a9-5da7-83e8-d40da7db83cb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-6817 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-storeconfig. CVE-2016-6817 (HTTP/2 header parser infinite loop) is NOT present in Apache Tomcat 8.5.78. The target version includes the upstream fix from commit 85c63227ed, authored by Mark Thomas (markt@apache.org), which shipped in Tomcat 8.5.7. The fix dynamically expands the header read buffer when capacity is exhausted, preventing the infinite loop that occurred when headers exceeded the fixed 1024-byte buffer. The vulnerable pattern (fixed-size buffer causing infinite loop when remaining() == 0 and payloadSize > 0) does not exist in the target code.", "justification": "code_not_present" } }, { "id": "CVE-2016-8747", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:c968a0f3-3969-5f17-9ccb-7bed0fdec472", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-8747 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-storeconfig. Apache Tomcat 8.5.78 is NOT vulnerable to CVE-2016-8747. The vulnerability affected versions 8.5.7-8.5.9 (and 9.0.0.M11-M15) due to incorrect ByteBuffer state management in Http11InputBuffer.nextRequest() that could allow cross-request information disclosure on persistent HTTP connections. The fix (commit 9601a937ff by Mark Thomas, December 2016) was applied upstream in Tomcat 8.5.10 and is present in the target's 8.5.78 release. The vulnerable pattern is not present; the code correctly calls byteBuffer.flip() after compact() and properly resets buffer state between requests.", "justification": "code_not_present" } }, { "id": "CVE-2017-12617", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:7615dafd-20c4-5577-a3f9-851359c2ee78", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-12617 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-storeconfig. The target (Apache Tomcat 8.5.78) is not affected by CVE-2017-12617. The vulnerability allowed uploading JSP files via HTTP PUT with specially crafted paths ending in '/' to bypass security checks (the Java File API drops trailing slashes). The upstream Apache Tomcat project fixed this in commits 506d862e7e and 4cf7dab882 (authored by Mark Thomas, September 2017) by adding checks that reject file write operations when the path ends with '/'. These fixes were already present in Apache Tomcat release 8.5.78 before TuxCare onboarded it (first TuxCare commit: fb98844404 \"Onboard version 8.5.78\" by amoniatovskiy@cloudlinux.com). The defensive code is verified present at AbstractFileResourceSet.java:69 and DirResourceSet.java:252.", "justification": "code_not_present" } }, { "id": "CVE-2017-5650", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:e004c355-430e-5e5a-90b7-482e1daebaac", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-5650 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-storeconfig. Apache Tomcat 8.5.78 is not affected by CVE-2017-5650. The vulnerability (HTTP/2 GOAWAY frames not closing streams waiting for WINDOW_UPDATE, causing thread exhaustion) was fixed in upstream commit 51eba9b70c by Mark Thomas (markt@apache.org). This fix was already present in the upstream release 8.5.78 that TuxCare onboarded, as confirmed by the fix commit being an ancestor of the first TuxCare commit fb98844404.", "justification": "code_not_present" } }, { "id": "CVE-2017-7675", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:bad55b70-c7ba-5ed5-8663-61c1b4782065", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-7675 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-storeconfig. Apache Tomcat 8.5.78 is NOT affected by CVE-2017-7675. The vulnerability (bypassing security constraints via path parameter stripping in HTTP/2 requests) was fixed in upstream Apache Tomcat by commit dacb030b85 on May 24, 2017. This fix was already present in the upstream Apache Tomcat 8.5.78 release that TuxCare onboarded in September 2026. The fix changes HTTP/2 `:path` header processing in Stream.java to set the URI as bytes (preserving path parameters) instead of as String (which stripped them), ensuring downstream security checks receive the complete path.", "justification": "code_not_present" } }, { "id": "CVE-2020-13934", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:b33fd4f9-1198-5e21-99a3-f3b5f10f33d0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-13934 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-storeconfig. Target version 8.5.78 is not affected by CVE-2020-13934. The vulnerability (failure to release HTTP/1.1 processor after h2c upgrade leading to memory exhaustion) was fixed in upstream Apache Tomcat by commit 923d834500 authored by Mark Thomas (markt@apache.org). This fix was included in the upstream 8.5.78 release, which is newer than the last affected version (8.5.56). The target repository contains the complete fix: the HTTP/1.1 processor is properly released via `release(processor)` before creating the HTTP/2 upgrade processor, and the control flow correctly uses `state = SocketState.CLOSED` to trigger cleanup.", "justification": "code_not_present" } }, { "id": "CVE-2020-13943", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:ee9e37f8-7d2e-5fdd-9340-2bdd01b05ca5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-13943 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-storeconfig. not_affected \u2014 Apache Tomcat 8.5.78 is not affected by CVE-2020-13943. The upstream fix was already present in version 8.5.78 when TuxCare onboarded it. The CVE affects versions 8.5.0 to 8.5.57; this is 8.5.78. The vulnerability involved HTTP/2 header confusion when concurrent stream limits were exceeded due to checking limits during initial header parsing (headersStart) rather than after complete parsing (he...", "justification": "code_not_present" } }, { "id": "CVE-2020-17527", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:9322e8fb-cb7f-525e-b324-88956bcef320", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-17527 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2020-9484", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:b7119783-f88d-525c-9a1d-e6b657f8af2d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-9484 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-storeconfig. CVE-2020-9484 deserialization vulnerability is NOT present in Apache Tomcat 8.5.78. The fix was authored by Mark Thomas (Apache upstream) on May 5, 2020, and shipped in Apache Tomcat 8.5.55. Version 8.5.78 inherits this fix from upstream. The FileStore.java file at lines 355-358 implements path traversal validation that rejects session IDs attempting to escape the storage directory, preventing deserialization of attacker-controlled files. CVE affected versions: 8.5.0 to 8.5.54; target version 8.5.78 is after the fixed version.", "justification": "code_not_present" } }, { "id": "CVE-2022-42252", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:c6dc1c24-f9ad-50a1-90be-15e90d60e18a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-42252 is fixed in version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2022-45143", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:8a49da89-086a-56b4-a60b-a76dd429a11e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-45143 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-storeconfig. CVE-2022-45143 affects JsonErrorReportValve, which does not exist in Tomcat 8.5.78. The vulnerability involves missing JSON escaping in type/message/description fields. The target version only has ErrorReportValve, which generates HTML error reports with proper HTML escaping (Escape.htmlElementContent). JsonErrorReportValve was introduced upstream on 2020-10-14 in versions 8.5.83+, 9.0.40+, and 10.1.0+, never backported to 8.5.78. The attack chain (user-provided error data \u2192 manipulated JSON output) cannot complete because JSON error reporting does not exist in the target. Verdict: not_affected per Rule 5 Type A2 (input received but chain to Goal broken by missing JSON generation).", "justification": "code_not_reachable" } }, { "id": "CVE-2023-24998", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:b59705dd-f252-59ce-878e-90ded458e841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-24998 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2023-28708", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:bd3264de-0def-51ae-9dce-baa9fbbf70ad", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-28708 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-storeconfig, and is fixed in 8.5.78-tuxcare.3." } }, { "id": "CVE-2023-41080", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:26866f26-65a3-58cb-8cc3-52a9af607973", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-41080 is fixed in version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2023-42794", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:a0f307b4-a92f-52ae-ae12-373b827f0745", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-42794 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-storeconfig. not_affected \u2014 Apache Tomcat 8.5.78-tuxcare.3 is not affected by CVE-2023-42794. The vulnerability was introduced by a refactoring in version 8.5.85 that removed the finalize() cleanup method from DiskFileItem.java. Since the target version (8.5.78) predates this refactoring, it retains the original finalize() method (lines 538-548) that provides automatic cleanup of temporary uploaded files during garbage co...", "justification": "code_not_present" } }, { "id": "CVE-2023-42795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:e2cde2f2-0297-5773-9473-54cc9f40209d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-42795 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2023-44487", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:1809c0af-0e78-5fa9-882d-007da3df1d70", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-44487 is fixed in version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2023-45648", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:375f2c8c-e953-59c8-8164-15535ec93f29", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-45648 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2023-46589", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:8e849d24-2ee3-56fd-809f-d0f594b6eb9a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-46589 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2024-21733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:a3f41c0c-b4bd-51f8-a10a-c9380a2631bc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-21733 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2024-24549", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:0d88ccdb-8a6d-56fb-994e-61db56865a57", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-24549 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2024-34750", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:b91d3c1e-4e34-51ab-ba59-32a5b76819e0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-34750 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2024-38286", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:167b74c4-132e-575a-a1e0-43340d714f01", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38286 is fixed in version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2024-50379", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:aaac56c9-3977-5e82-a1f3-6d69866d94d7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-50379 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2024-52316", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:518fdf9f-3543-5fe2-a7ef-5d7dfe36a1b8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-52316 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2024-56337", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:38c52544-b6f9-57e9-8b93-0e00c75aba84", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-56337 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2025-24813", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:b97d0c6a-7f14-5f46-8830-510322f65bac", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-24813 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2025-31650", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:58424054-26b3-51a7-9eaa-6e0ae4d5d1a8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-31650 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-storeconfig. Apache Tomcat 8.5.78 is NOT AFFECTED by CVE-2025-31650. This vulnerability requires RFC 9218 HTTP Extensible Priorities support, which was not introduced until version 8.5.90. Version 8.5.78 lacks the Priority class, PRIORITY_UPDATE frame type, readPriorityUpdateFrame() method, and all priority header parsing code that contains the vulnerability. The CVE's affected version range (8.5.90-8.5.100) correctly excludes 8.5.78.", "justification": "code_not_present" } }, { "id": "CVE-2025-31651", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:daa12ca6-7fe1-55a8-a4c7-b7151dc6e6c8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31651 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2025-46701", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:da5df7f2-d942-5b6e-93f2-183e2dfe98a9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-46701 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2025-48988", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:55f76801-e26d-5bfe-a4b7-9971a502875d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-48988 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2025-48989", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:71fe8d68-571e-5f72-9de9-5168e9eb2037", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-48989 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2025-49124", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:70d2b1c0-cb4e-5452-a55b-b4efd6c63855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49124 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2025-49125", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:49dee3ba-978d-5990-b5ee-cc1c63b33ff1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49125 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2025-52434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:81ec90ff-eb13-5f9a-8788-484277f0f14d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-52434 is fixed in version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2025-52520", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:8e160a09-a8ce-5c26-a494-18212da175d7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-52520 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2025-53506", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:d99c1409-3e02-55c5-8c46-70246877899e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-53506 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2025-55668", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:dec43c47-110a-5103-91de-a29b982f58a3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55668 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2025-55752", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:2c05aacc-9b8d-5d9c-adee-ae5f939193de", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-55752 is fixed in version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2025-55754", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:cb65a68a-f5df-5b22-a894-a78e07c20969", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-55754 is fixed in version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2025-61795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:d778a60c-122e-572f-b718-65aca4baa2fa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-61795 is fixed in version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2025-66614", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:cf844e54-c95b-5fd5-b5ff-ffa19958bed4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66614 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2026-24733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:e691541d-5c2e-583b-b710-9ec76a89dab7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-24733 is fixed in version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2026-24734", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:e98d43e0-9fe7-5db9-8f98-d2c96cdda064", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24734 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2026-24880", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:0969e11a-ddfe-54d0-95ac-00e07d0243a2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-24880 is fixed in version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2026-25854", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:e19eda9e-2612-5820-9cb3-3526a584575b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25854 is fixed in version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2026-29146", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:a207488e-2f5f-555c-a3b2-337cf6255283", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29146 is fixed in version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2026-34483", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:a52b93df-a7f4-59fd-b5b1-554350f05d8d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34483 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2026-34487", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:40b239ac-e69e-5dc4-802e-8867d076707c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34487 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2026-41284", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:1fdefe42-b44d-5bbd-8c62-63891314cb1b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41284 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2026-41293", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:762c527d-924c-5269-a2ab-8d27e98eb82f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41293 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2026-42498", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:1e61842c-5289-5528-b4be-773cb84a9198", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42498 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2026-43512", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:ab556d0a-63bc-5583-aed1-90a2606c16a8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43512 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2026-43513", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:a440c046-0c62-59a8-9100-4be3707e543d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43513 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2026-43514", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:48d4ffd7-29f6-5099-8542-39292dcd4b44", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43514 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2026-43515", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:88f16d87-1e28-5db1-a999-60996fb305e7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43515 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2026-53434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:7e93c71a-a9a3-5a89-8e2c-0660e1e7658a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53434 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2026-65182", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:762726c4-0245-5a3b-8321-10b74397e3ee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65182 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2026-65905", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:6ed448b8-37e1-5572-a233-820185e0093e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65905 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2026-68525", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:a2144656-dc2d-5499-9843-c60caf051e62", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-68525 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat-storeconfig." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.78-tuxcare.2" } ] }