{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:d979c1ef-42b4-57eb-a670-bae451cfe008",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "tomcat-websocket",
      "purl": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.55-tuxcare.1",
      "type": "library",
      "group": "org.apache.tomcat",
      "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.55-tuxcare.1",
      "version": "10.1.55-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "tomcat-websocket",
            "purl": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.55",
            "type": "library",
            "group": "org.apache.tomcat",
            "version": "10.1.55"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2020-13935",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.55-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:d21b9cca-7993-5d83-837d-4747decb65b6",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2020-13935 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-websocket."
      }
    },
    {
      "id": "CVE-2022-45143",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.55-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:33d5dfa3-661f-5070-b27c-d00807e6f8ca",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-45143 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-websocket."
      }
    },
    {
      "id": "CVE-2023-42795",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.55-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:c5f380b8-c78c-5af4-ace0-1853abcc073c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-42795 does not affect version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-websocket. not_affected \u2014 CVE-2023-42795 (Incomplete Cleanup vulnerability) is not present in Tomcat 10.1.55. The upstream fix by Mark Thomas (commit 9375d67106) was included in the Apache Tomcat 10.1.55 release that TuxCare onboarded. All required defensive changes are present: try-catch blocks in recycle() methods for Request.java, ApplicationHttpRequest.java, B2CConverter.java, and C2BConverter.java ensure cleanup co...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-23672",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.55-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:1fb1dcfb-4006-554b-b12f-6079c0425734",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-23672 does not affect version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-websocket. not_affected \u2014 Apache Tomcat 10.1.55 is NOT affected by CVE-2024-23672. The vulnerability (incomplete WebSocket session cleanup leading to DoS) was fixed in upstream Apache Tomcat 10.1.19 and later versions. The target version 10.1.55 contains the complete fix, which was introduced by upstream commit 0052b37468 (authored by Mark Thomas, markt@apache.org, on 2024-01-18). This fix was already present in the ups...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-53434",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.55-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:e8487f57-b779-58ce-a8b4-91c1d0cbfef3",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-53434 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-websocket."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.55-tuxcare.1"
    }
  ]
}