{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:0977da13-531a-52ae-86f0-9b38359a2bef",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "tomcat-util-scan",
      "purl": "pkg:maven/org.apache.tomcat/tomcat-util-scan@8.5.46-tuxcare.1",
      "type": "library",
      "group": "org.apache.tomcat",
      "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-util-scan@8.5.46-tuxcare.1",
      "version": "8.5.46-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "tomcat-util-scan",
            "purl": "pkg:maven/org.apache.tomcat/tomcat-util-scan@8.5.46",
            "type": "library",
            "group": "org.apache.tomcat",
            "version": "8.5.46"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2019-2684",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-util-scan@8.5.46-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:ba86dd16-4ea0-5703-adef-22c0479b6772",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-2684 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-util-scan. not_affected \u2014 Tomcat 8.5.46 contains vulnerable JMX/RMI code that could expose CVE-2019-2684 (Java SE RMI deserialization), but this code is not reachable in the default shipped configuration. The vulnerable JmxRemoteLifecycleListener class exists in the codebase and uses the unpatched `LocateRegistry.createRegistry()` + `registry.bind()` pattern that allows unauthorized RMI registry modifications. However, ...",
        "justification": "code_not_reachable"
      }
    },
    {
      "id": "CVE-2022-45143",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-util-scan@8.5.46-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:e9807a78-f935-5f09-8d91-14f8e89ee6c0",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-45143 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-util-scan. Tomcat 8.5.46 is not affected by CVE-2022-45143. The vulnerable component JsonErrorReportValve does not exist in this version - it was introduced later in version 8.5.83. Version 8.5.46 only has ErrorReportValve which produces HTML error pages, not JSON. The CVE correctly identifies 8.5.83 as the first affected version in the 8.5.x series. No JSON error reporting capability exists in 8.5.46, therefore the vulnerability pattern (unescaped user-controlled values in JSON output) cannot occur.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-42795",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-util-scan@8.5.46-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:b8906804-3580-5b5d-990e-44261ae19aa9",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-42795 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-util-scan."
      }
    },
    {
      "id": "CVE-2026-53434",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-util-scan@8.5.46-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:deab87c3-3c4e-5c9f-a394-88e9921dacc9",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-53434 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-util-scan."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.tomcat/tomcat-util-scan@8.5.46-tuxcare.1"
    }
  ]
}