{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:db05a242-240a-5375-8ecd-0889f9bd3c69", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat", "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.1", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.1", "version": "10.1.16-tuxcare.1", "pedigree": { "ancestors": [ { "name": "tomcat", "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.16", "type": "library", "group": "org.apache.tomcat", "version": "10.1.16" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2008-1947", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:112b2cd8-c6a2-5790-aeec-96c2bfe7b3c3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2008-1947 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2013-4590", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:2d9d67fc-b5c9-5c7d-aff6-3422dc7cd031", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2013-4590 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2015-5174", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:77f319d2-f16d-5970-a1f9-7910997a8964", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5174 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2015-5346", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:c5069ba6-cbf4-5c6a-b7e0-2775f0ae2e9b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5346 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2016-0706", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:690aed0f-ab02-5dea-92bc-ebf4b5e65537", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-0706 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2016-0762", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:8458049e-2c07-573b-a1e7-b9ce6e42538e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-0762 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2016-0763", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:f0d89863-d60a-54ac-bc7f-88352e818172", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-0763 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2016-6794", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:43cb32d2-cd63-536d-952a-873a6edabd1b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-6794 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2016-6796", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:e1da9f4a-3025-5686-acdc-22d5d82ecd31", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-6796 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2016-6797", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:d7e3dc0e-5145-54c3-b89e-cf24f77d387f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-6797 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2016-6817", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:d04bed39-8b6b-5f7e-a565-17c13bf64769", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-6817 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2016-8747", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:c2dcdcc7-c973-5d3f-9885-55eccc95392b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-8747 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2017-5647", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:0394462e-d39c-534c-a52b-c4698ef30ff2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-5647 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2017-5650", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:f17fd76a-3f02-5e72-9387-84cb14cda67a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-5650 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2017-5664", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:222120d4-37a1-577b-b8b3-8e40ca546743", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-5664 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2017-7674", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:45f72d0c-26fb-5051-b599-e758d9273890", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7674 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2017-7675", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:9b98d299-48c0-5342-8aa6-ae29f98c4213", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7675 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2019-0221", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:eb0b482e-daea-52ce-b864-c13c36261bb3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-0221 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2019-17569", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:bcecd19d-f9fb-5581-a1ff-e1d76720a84a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17569 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2020-11996", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:cf689e10-17bb-5d77-91ee-2b9dc7f12943", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-11996 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2020-13934", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:c41ad59c-cc4f-5a64-abcd-a20e8590e9f0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-13934 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2020-13935", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:e4cc022c-8595-59d0-99e2-f80b9aa53ece", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-13935 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2020-1935", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:27882ba1-cced-57af-af1d-31b840ab8c06", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-1935 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2020-8022", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:08c4b8a6-f5fe-5916-958d-f144a959c1b5", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2020-8022 is a false positive for org.apache.tomcat:tomcat 10.1.16-tuxcare.1." } }, { "id": "CVE-2021-30639", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:da337d37-9084-59ca-92f2-9307ca21bfd8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-30639 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2021-30640", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:f5831a4b-6951-5f6d-9523-4d9825cac565", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-30640 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2021-33037", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:4b250cc8-b43e-576b-b108-e53192a6a2a1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-33037 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2021-33037 is NOT present in target Tomcat 10.1.16. All three vulnerability patterns have been fixed by upstream Apache commits that shipped in the upstream 10.1.16 release, prior to TuxCare onboarding. The fixes include: (1) rejection of \"identity\" transfer encoding with 501 error, (2) processing Transfer-Encoding headers from HTTP/1.0 clients (not just HTTP/1.1), and (3) ensuring chunked ...", "justification": "code_not_present" } }, { "id": "CVE-2021-41079", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:66c78018-8047-504a-9f07-04f9c1241831", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-41079 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2021-42340", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:30505805-51d8-51ae-b5ba-b64b0e7b67bb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-42340 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2021-43980", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:dcae83d1-a209-5d07-8a79-884c063f105a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-43980 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2021-43980 (processor sharing concurrency bug) is NOT present in Tomcat 10.1.16. The upstream fix commit 17f177eeb7 from March 2022 was already included in the upstream Tomcat 10.1.16 release that TuxCare onboarded in October 2026. The fix uses AtomicReference for thread-safe processor ownership and the atomic takeCurrentProcessor() method to prevent concurrent access. This is an upstream f...", "justification": "code_not_present" } }, { "id": "CVE-2022-23181", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:480e81ab-e7c9-52af-8f2c-677f0e2c0633", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-23181 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2022-25762", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:e1c5ac8b-2e48-5a5e-8260-9e10bc5b2f92", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-25762 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2022-29885", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:f9ba1aa3-e4db-58a4-9123-ae101a2e843d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-29885 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2022-34305", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:38db8f6e-b870-580d-90f8-de0bee45e839", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-34305 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2022-34305 is NOT present in Apache Tomcat 10.1.16. The XSS vulnerability in the Form authentication example was fixed by upstream Apache in commit d6251d1cfb, which was already included in the Apache Tomcat 10.1.16 release that TuxCare onboarded. The vulnerable code (unescaped output of session and principal attributes) has been replaced with properly HTML-escaped output using util.HTMLFil...", "justification": "code_not_present" } }, { "id": "CVE-2023-41080", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:520b891d-cf61-5324-abcd-f2796266c038", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-41080 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2023-41080 (open redirect via protocol-relative URLs in FORM authentication) is NOT present in Apache Tomcat 10.1.16. The upstream fix (commit bb4624a9f3) was already included in the Tomcat 10.1.16 release before TuxCare onboarded it. The vulnerable pattern (missing sanitization of leading slashes in savedRequestURL) does not exist; the fix code at FormAuthenticator.java:765-768 strips lead...", "justification": "code_not_present" } }, { "id": "CVE-2023-42795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:32aba5aa-956e-5bb8-97cb-f5cf4d0b04dc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-42795 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat. not_affected \u2014 Apache Tomcat 10.1.16 is not affected by CVE-2023-42795. The vulnerability affects versions 10.1.0-M1 through 10.1.13, and was fixed in 10.1.14 and later. Since 10.1.16 > 10.1.14, the fix was already present in the upstream release when TuxCare onboarded it. All five recycle() method fixes (exception handling in Request.part.delete(), ApplicationHttpRequest.session.endAccess(), B2CConverter.dec...", "justification": "code_not_present" } }, { "id": "CVE-2023-45648", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:081514c7-892c-5b31-8a3e-bffff2232867", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-45648 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat. not_affected \u2014 The target Tomcat 10.1.16 is NOT AFFECTED by CVE-2023-45648. The vulnerability involves improper validation of HTTP trailer headers that could enable request smuggling. The upstream fix (commit 8ecff306507be8e4fd3adee1ae5de1ea6661a8f4 by Mark Thomas) was already present in the Tomcat 10.1.16 release that TuxCare onboarded. Both ChunkedInputFilter.java and Http11InputBuffer.java contain the requ...", "justification": "code_not_present" } }, { "id": "CVE-2024-54677", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:e86faa18-fd26-53e9-a4b9-8872c53dacac", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-54677 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2025-49124", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:f1c32194-a823-572b-a923-9fd6599b6501", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49124 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2025-55752", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:31c95b4e-0862-56cf-8d0c-8666dc622acf", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-55752 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat. Version 10.1.16 is NOT vulnerable to CVE-2025-55752. The vulnerable code pattern (normalizing before decoding in RewriteValve) was introduced later in version 10.1.40. Version 10.1.16 uses a different code structure that does not call URLDecoder.decode after RequestUtil.normalize, thus the vulnerability is not present. The CVE advisory's version range \"10.1.0-M1 through 10.1.44\" is over-broad; only versions 10.1.40-10.1.44 contain the vulnerable pattern.", "justification": "code_not_present" } }, { "id": "CVE-2025-55754", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:d027c698-fd9f-5d7b-a4ce-ef6b2a2f3b9b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55754 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2025-61795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:e7c93e08-3a9a-5b88-9b73-4fd9e9a6d1ee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-61795 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2025-66614", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:027f5dc5-ccee-5c68-b83d-e53220957e77", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66614 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-25854", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:3575af93-f9c8-56be-adf5-25bfb33ea26d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25854 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-29129", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:4b873c5b-5a16-51e4-8d0d-91882cb672b0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-29129 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-29145", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:d7486988-1386-55c8-b3f3-b9091e1a9a62", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29145 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-29146", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:a37c85b7-0c5c-5a90-8721-40a2518e7168", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29146 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-32990", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:8ca1a523-5be4-5bbd-ae60-4b11cf21610e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-32990 does not affect version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat. not_affected \u2014 Apache Tomcat 10.1.16 is not affected by CVE-2026-32990. The vulnerability exists in the checkSni() method's incomplete fix for CVE-2025-66614, affecting versions 10.1.50-10.1.52. Version 10.1.16 predates the introduction of the strict SNI validation feature entirely - the checkSni method, strictSni field, and protocolHostName parameter do not exist in this version. The vulnerability pattern (c...", "justification": "code_not_present" } }, { "id": "CVE-2026-34483", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:21c05022-8654-5261-80ff-4c751bdd00f8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34483 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-34486", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:dccd06e0-6fcf-5f70-b8cc-b8268aeff4ad", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34486 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-34487", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:00005760-a901-5f33-a3c2-ad9b79ac2b38", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34487 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-41284", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:62adf29e-496e-54b6-b4e0-fc214ef8e01e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41284 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-41293", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:96092044-bcfc-5522-a62f-39fc41caccba", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41293 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-42498", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:2b5512a8-810f-58a5-9e6c-dc1a5a4a1a47", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42498 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-43512", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:4eddfd8d-6281-5b06-97b7-09e8ef2339d7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43512 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-43513", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:d55b6232-e86d-5994-a80c-5483364ee3e0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43513 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-43514", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:13cd8908-a6e0-5194-beba-22a10fc8ffd0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43514 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-43515", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:ce511a8f-09fb-55d3-94b9-34e630c0ec21", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-43515 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-65182", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:bfd147da-3efd-5c49-8279-1b4a0a06da37", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65182 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-65905", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:5cb03851-b121-5ab6-bfdb-e1f6903fad8a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65905 affects version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-68525", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.1" } ], "bom-ref": "urn:uuid:fb46ef92-e73c-581a-a8f3-beb3465a2d9a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68525 is fixed in version 10.1.16-tuxcare.1 of org.apache.tomcat:tomcat." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@10.1.16-tuxcare.1" } ] }