{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:e44f95ff-e9c6-520f-8333-91ea544de145",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "tomcat-websocket",
      "purl": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.42-tuxcare.11",
      "type": "library",
      "group": "org.apache.tomcat",
      "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.42-tuxcare.11",
      "version": "10.1.42-tuxcare.11",
      "pedigree": {
        "ancestors": [
          {
            "name": "tomcat-websocket",
            "purl": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.42",
            "type": "library",
            "group": "org.apache.tomcat",
            "version": "10.1.42"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2020-13935",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:7e4cac0e-1eed-57c5-946c-caa4a3378925",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2020-13935 affects version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat-websocket."
      }
    },
    {
      "id": "CVE-2022-45143",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:bfe4f10d-d8a9-5f7b-968a-af687bc82e84",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-45143 affects version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat-websocket."
      }
    },
    {
      "id": "CVE-2023-42795",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:a7b78ff6-35fa-55d4-8d01-f3b3bb0c5e8c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-42795 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat-websocket. not_affected \u2014 CVE-2023-42795 is NOT present in the target. The vulnerability involves incomplete cleanup during recycling of internal objects, which could leak information between requests. The upstream Apache Tomcat project fixed this in version 10.1.14 (released October 2023) by adding robust error handling to ensure all recycling steps complete even if exceptions occur. The target version 10.1.42 (release...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-23672",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:a948a8c0-dcd8-51fa-b654-6f78c4727aaa",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-23672 does not affect version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat-websocket. Tomcat 10.1.42 is not vulnerable because CVE-2024-23672 is fixed in 10.1.19 and affects only 10.1.0-M1 through 10.1.18, and 10.1.42 is later than 10.1.19.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-53434",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.42-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:92781287-0c12-5c96-a2ee-b7ecfaf395f2",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-53434 affects version 10.1.42-tuxcare.11 of org.apache.tomcat:tomcat-websocket."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.42-tuxcare.11"
    }
  ]
}