{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:da1bb87b-12a4-5f22-ba99-cc3b3a2c8c36",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "tomcat-util-scan",
      "purl": "pkg:maven/org.apache.tomcat/tomcat-util-scan@10.1.42-tuxcare.10",
      "type": "library",
      "group": "org.apache.tomcat",
      "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-util-scan@10.1.42-tuxcare.10",
      "version": "10.1.42-tuxcare.10",
      "pedigree": {
        "ancestors": [
          {
            "name": "tomcat-util-scan",
            "purl": "pkg:maven/org.apache.tomcat/tomcat-util-scan@10.1.42",
            "type": "library",
            "group": "org.apache.tomcat",
            "version": "10.1.42"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2022-45143",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-util-scan@10.1.42-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:891437d3-a030-5403-937c-303e8dd1baf3",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-45143 affects version 10.1.42-tuxcare.10 of org.apache.tomcat:tomcat-util-scan."
      }
    },
    {
      "id": "CVE-2023-42795",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-util-scan@10.1.42-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:3d3a4db0-c212-5050-bb68-8b883423f016",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-42795 does not affect version 10.1.42-tuxcare.10 of org.apache.tomcat:tomcat-util-scan. not_affected \u2014 CVE-2023-42795 is NOT present in the target. The vulnerability involves incomplete cleanup during recycling of internal objects, which could leak information between requests. The upstream Apache Tomcat project fixed this in version 10.1.14 (released October 2023) by adding robust error handling to ensure all recycling steps complete even if exceptions occur. The target version 10.1.42 (release...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-53434",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-util-scan@10.1.42-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:5704f570-39ca-594e-96be-9818052adab7",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-53434 affects version 10.1.42-tuxcare.10 of org.apache.tomcat:tomcat-util-scan."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.tomcat/tomcat-util-scan@10.1.42-tuxcare.10"
    }
  ]
}