{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:99fe51a8-f782-59fe-86f4-8e96cd06c03b",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "tomcat-tribes",
      "purl": "pkg:maven/org.apache.tomcat/tomcat-tribes@10.1.55-tuxcare.1",
      "type": "library",
      "group": "org.apache.tomcat",
      "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-tribes@10.1.55-tuxcare.1",
      "version": "10.1.55-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "tomcat-tribes",
            "purl": "pkg:maven/org.apache.tomcat/tomcat-tribes@10.1.55",
            "type": "library",
            "group": "org.apache.tomcat",
            "version": "10.1.55"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-29146",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-tribes@10.1.55-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:15352f67-563c-57a4-b1fd-3dcb132b9b36",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-29146 does not affect version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-tribes. Target version 10.1.55 is not affected by CVE-2026-29146. The CVE affects Apache Tomcat versions through 10.1.52, with fixes shipped in 10.1.53+. The target contains upstream fixes (commits 607ebc0fa5 and 55f3eb9148 by markt@apache.org) that mitigate the padding oracle vulnerability through improved error handling and algorithm validation. The error handling ensures all decryption failures are handled uniformly (message dropped, error logged), preventing attackers from distinguishing padding errors from other decryption failures. Algorithm validation warns users that CBC/PKCS5Padding is not recommended and suggests switching to AES/GCM/NoPadding. Both fixes were present in the upstream 10.1.55 release before TuxCare onboarded it.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-34486",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-tribes@10.1.55-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:a019ad08-fcb0-537a-988b-cb1d9caa44bf",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-34486 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-tribes."
      }
    },
    {
      "id": "CVE-2026-34487",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-tribes@10.1.55-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:aa52b951-fb7e-5c68-bb24-263b83e44c55",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-34487 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-tribes."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.tomcat/tomcat-tribes@10.1.55-tuxcare.1"
    }
  ]
}