{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:bef3b417-aa19-5ce4-b002-f7ccf0569d1d",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "tomcat-util",
      "purl": "pkg:maven/org.apache.tomcat/tomcat-util@9.0.83-tuxcare.6",
      "type": "library",
      "group": "org.apache.tomcat",
      "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-util@9.0.83-tuxcare.6",
      "version": "9.0.83-tuxcare.6",
      "pedigree": {
        "ancestors": [
          {
            "name": "tomcat-util",
            "purl": "pkg:maven/org.apache.tomcat/tomcat-util@9.0.83",
            "type": "library",
            "group": "org.apache.tomcat",
            "version": "9.0.83"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2016-8745",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-util@9.0.83-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:23619867-c9e2-558d-91d4-7cc02e6b60bc",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2016-8745 affects version 9.0.83-tuxcare.6 of org.apache.tomcat:tomcat-util."
      }
    },
    {
      "id": "CVE-2022-45143",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-util@9.0.83-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:04e0ec51-1df6-59ed-b114-103d03aeb740",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-45143 does not affect version 9.0.83-tuxcare.6 of org.apache.tomcat:tomcat-util. Apache Tomcat 9.0.83 is not affected by CVE-2022-45143. The upstream Apache fix (commit b336f4e58893ea35114f1e4a415657f723b1298e by Mark Thomas) was already present in the upstream 9.0.83 release, which serves as the base for this TuxCare branch. The JsonErrorReportValve properly escapes type, message, and description fields using JSONFilter.escape() before embedding them in JSON output, preventing the JSON injection vulnerability. The CVE affects versions 9.0.40 to 9.0.68; this version (9.0.83) is outside the affected range.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-42795",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-util@9.0.83-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:d4b456e7-eddf-551a-8562-534b8e30cf25",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-42795 does not affect version 9.0.83-tuxcare.6 of org.apache.tomcat:tomcat-util. not_affected \u2014 CVE-2023-42795 fix is already present in the target repository. The vulnerability addresses incomplete cleanup during object recycling that could leak information between requests. The fix, authored by Mark Thomas (markt@apache.org) in upstream commit 44d05d75d696ca10ce251e4e370511e38f20ae75, was included in Apache Tomcat 9.0.81 and is present in the target's base version 9.0.83. All four affec...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-53434",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-util@9.0.83-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:19271c70-b03f-5faf-9cca-17c0a1ce6cf0",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-53434 affects version 9.0.83-tuxcare.6 of org.apache.tomcat:tomcat-util."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.tomcat/tomcat-util@9.0.83-tuxcare.6"
    }
  ]
}