{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:a85e0623-4a61-562d-a8e1-13232438f57a",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "tomcat-util-scan",
      "purl": "pkg:maven/org.apache.tomcat/tomcat-util-scan@10.1.33-tuxcare.1",
      "type": "library",
      "group": "org.apache.tomcat",
      "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-util-scan@10.1.33-tuxcare.1",
      "version": "10.1.33-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "tomcat-util-scan",
            "purl": "pkg:maven/org.apache.tomcat/tomcat-util-scan@10.1.33",
            "type": "library",
            "group": "org.apache.tomcat",
            "version": "10.1.33"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2022-45143",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-util-scan@10.1.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:66d615e8-9c7a-581c-bcb7-bbffaee7e0be",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-45143 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat-util-scan."
      }
    },
    {
      "id": "CVE-2023-42795",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-util-scan@10.1.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:fe296d39-23e5-59c1-a889-e9ac1a0ee7c8",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-42795 does not affect version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat-util-scan. not_affected \u2014 Target version 10.1.33 is NOT affected by CVE-2023-42795. The vulnerability affects Tomcat 10.1.0-M1 through 10.1.13, and was fixed in 10.1.14 onwards. The upstream Apache Tomcat fix (commit 30f8063d7a by Mark Thomas, dated Oct 5, 2023) was already present in the 10.1.33 release when TuxCare onboarded it. All four affected files (Request.java, ApplicationHttpRequest.java, B2CConverter.java, C2B...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-53434",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-util-scan@10.1.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:9359e54f-f57b-5292-a24d-26655801d801",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-53434 affects version 10.1.33-tuxcare.1 of org.apache.tomcat:tomcat-util-scan."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.tomcat/tomcat-util-scan@10.1.33-tuxcare.1"
    }
  ]
}