{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:c03a5e05-c8be-5951-b46f-da27a87b9444",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "tomcat-websocket",
      "purl": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.50-tuxcare.1",
      "type": "library",
      "group": "org.apache.tomcat",
      "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.50-tuxcare.1",
      "version": "10.1.50-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "tomcat-websocket",
            "purl": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.50",
            "type": "library",
            "group": "org.apache.tomcat",
            "version": "10.1.50"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2020-13935",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.50-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:677a50bf-c77f-559d-b0ef-6d3267187a9f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2020-13935 affects version 10.1.50-tuxcare.1 of org.apache.tomcat:tomcat-websocket."
      }
    },
    {
      "id": "CVE-2022-45143",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.50-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:4d2c50fe-99d4-5306-b4f7-37baabca6f79",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-45143 affects version 10.1.50-tuxcare.1 of org.apache.tomcat:tomcat-websocket."
      }
    },
    {
      "id": "CVE-2023-42795",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.50-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:e810d1b3-913c-55e9-b81f-3f7370699e18",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-42795 does not affect version 10.1.50-tuxcare.1 of org.apache.tomcat:tomcat-websocket. not_affected \u2014 CVE-2023-42795 is NOT present in Tomcat 10.1.50. The upstream fix (commit 9375d67106f by Mark Thomas on 2023-10-05) was already included in the upstream release before TuxCare onboarded version 10.1.50. All four affected recycle() methods (Request.java, ApplicationHttpRequest.java, B2CConverter.java, C2BConverter.java) contain the protective try-catch blocks that prevent exceptions from abortin...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-23672",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.50-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:ea12ea43-a04a-5941-8080-bd06ee4483f8",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-23672 does not affect version 10.1.50-tuxcare.1 of org.apache.tomcat:tomcat-websocket. not_affected \u2014 Apache Tomcat 10.1.50 is not affected by CVE-2024-23672. The vulnerability (incomplete WebSocket connection cleanup leading to resource exhaustion) was fixed in upstream Apache Tomcat 10.1.19 (released February 2024). Since version 10.1.50 was released December 2025 (much later than the fix), it inherently includes the upstream fix. The target code contains all fix components: SESSION_CLOSE_TIM...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-53434",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.50-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:5945779a-a734-58b7-a53f-970a47254163",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-53434 affects version 10.1.50-tuxcare.1 of org.apache.tomcat:tomcat-websocket."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.50-tuxcare.1"
    }
  ]
}