{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:378e5617-bc43-511c-8b06-f890136138be", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat", "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.2", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.2", "version": "8.5.78-tuxcare.2", "pedigree": { "ancestors": [ { "name": "tomcat", "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.78", "type": "library", "group": "org.apache.tomcat", "version": "8.5.78" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2008-1947", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:16ae4a7e-5278-5792-8e12-b424f18bac0d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2008-1947 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2013-4590", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:c177e358-91a3-5ae4-ace7-875b78970b94", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2013-4590 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2015-5174", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:b3538be3-dd24-5a39-8484-e012e0ecbdfc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5174 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2015-5346", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:1881a059-9cba-5f9d-bbe9-c9c4ca929ad2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5346 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2016-0706", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:17a55b0e-e403-5a72-8d1c-6384e724f23c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-0706 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2016-0762", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:f1b15c2a-cd5e-5d0a-879c-ad0031e8590e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-0762 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2016-0762 timing attack vulnerability is NOT present in Tomcat 8.5.78. The upstream Apache fix (commit d79c63d424) was included in version 8.5.5 (released 2016-08-31), well before version 8.5.78 was released. All four critical Realm implementations (RealmBase, DataSourceRealm, JDBCRealm, MemoryRealm) contain the timing attack mitigation code that calls getCredentialHandler().mutate(credenti...", "justification": "code_not_present" } }, { "id": "CVE-2016-0763", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:218f601d-6a1c-5e6f-b332-fe9e5b36b7a1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-0763 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2016-0763 is NOT present in Tomcat 8.5.78. The vulnerability affects the setGlobalContext method in ResourceLinkFactory.java, which in vulnerable versions lacks authorization checks, allowing untrusted web applications to replace the global JNDI context and access arbitrary application data or cause DoS. The fix (commit bc8717f41a by upstream Apache developer kkolinko@apache.org) adds a Sec...", "justification": "code_not_present" } }, { "id": "CVE-2016-6794", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:fd845597-8ce1-5b03-8482-cc69501de015", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-6794 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 Apache Tomcat 8.5.78 is not affected by CVE-2016-6794. The vulnerability allows malicious web applications to bypass SecurityManager and read system properties via the configuration file property replacement feature. The fix (PermissionCheck mechanism) was already present in the upstream Apache Tomcat 8.5.78 release that TuxCare onboarded, applied by upstream author Mark Thomas in commit f8db07...", "justification": "code_not_present" } }, { "id": "CVE-2016-6796", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:a2bd615c-632f-51c7-8b85-97b2f4b4ce93", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-6796 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat. The target Tomcat 8.5.78 is NOT vulnerable to CVE-2016-6796. The vulnerability allowed malicious web applications to bypass SecurityManager restrictions by manipulating JSP servlet init-parameters `engineOptionsClass` and `scratchdir`. The fix, which adds SecurityManager checks to nullify these dangerous parameters when SecurityManager is enabled, is already present in the target code. This fix was authored by upstream maintainer Mark Thomas (markt@apache.org) in commit f97769f50e on August 30, 2016, and was included in the upstream 8.5.78 release that TuxCare onboarded. The vulnerable code pattern does not exist in this version.", "justification": "code_not_present" } }, { "id": "CVE-2016-6797", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:cbad779b-0083-599f-bfa9-9287075358db", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-6797 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat. CVE-2016-6797 is NOT present in Apache Tomcat 8.5.78. The vulnerability allowed web applications to access any global JNDI resource without explicit ResourceLink configuration. The upstream fix (commit d6b5600afe by Mark Thomas, August 22, 2016) added an access control mechanism that validates ClassLoader authorization before allowing global resource access. This fix was already present in the upstream Tomcat 8.5.78 release that TuxCare onboarded, making the target not affected by this vulnerability.", "justification": "code_not_present" } }, { "id": "CVE-2016-6817", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:efed4c65-0406-5397-8c1e-67aa81c9d923", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-6817 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat. CVE-2016-6817 (HTTP/2 header parser infinite loop) is NOT present in Apache Tomcat 8.5.78. The target version includes the upstream fix from commit 85c63227ed, authored by Mark Thomas (markt@apache.org), which shipped in Tomcat 8.5.7. The fix dynamically expands the header read buffer when capacity is exhausted, preventing the infinite loop that occurred when headers exceeded the fixed 1024-byte buffer. The vulnerable pattern (fixed-size buffer causing infinite loop when remaining() == 0 and payloadSize > 0) does not exist in the target code.", "justification": "code_not_present" } }, { "id": "CVE-2016-8747", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:967fea5f-ccae-5d5b-8ff9-dcd1e8c13eb1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-8747 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat. Apache Tomcat 8.5.78 is NOT vulnerable to CVE-2016-8747. The vulnerability affected versions 8.5.7-8.5.9 (and 9.0.0.M11-M15) due to incorrect ByteBuffer state management in Http11InputBuffer.nextRequest() that could allow cross-request information disclosure on persistent HTTP connections. The fix (commit 9601a937ff by Mark Thomas, December 2016) was applied upstream in Tomcat 8.5.10 and is present in the target's 8.5.78 release. The vulnerable pattern is not present; the code correctly calls byteBuffer.flip() after compact() and properly resets buffer state between requests.", "justification": "code_not_present" } }, { "id": "CVE-2017-5647", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:2c32a886-5c7b-5e37-b519-842c6b9ac073", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-5647 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat. CVE-2017-5647 is NOT present in Tomcat 8.5.78. The vulnerability (pipelined requests being lost during sendfile processing, causing response-to-request mismatches) was fixed in upstream Tomcat 8.5.13 (March 2017) by commit f5e06b8c74. The fix introduced the SendfileKeepAliveState enum with three states (NONE, PIPELINED, OPEN) to properly handle pipelined requests when sendfile completes. Version 8.5.78 shipped with this fix already in place. The fix was authored by Apache upstream (markt@apache.org), not TuxCare. All key fix components are verified present: the new enum, the input buffer check in Http11Processor.processSendfile(), and the three-state switch logic in all endpoint implementations (AprEndpoint, Nio2Endpoint, NioEndpoint).", "justification": "code_not_present" } }, { "id": "CVE-2017-5650", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:681f7d2c-52be-5f1a-bedf-1cfe47799f6b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-5650 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat. Apache Tomcat 8.5.78 is not affected by CVE-2017-5650. The vulnerability (HTTP/2 GOAWAY frames not closing streams waiting for WINDOW_UPDATE, causing thread exhaustion) was fixed in upstream commit 51eba9b70c by Mark Thomas (markt@apache.org). This fix was already present in the upstream release 8.5.78 that TuxCare onboarded, as confirmed by the fix commit being an ancestor of the first TuxCare commit fb98844404.", "justification": "code_not_present" } }, { "id": "CVE-2017-5664", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:cff95ea7-d8db-5aaa-a900-dac0c0117860", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-5664 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat. Target Apache Tomcat 8.5.78 is NOT AFFECTED by CVE-2017-5664. The vulnerability affects Tomcat versions 8.5.0 to 8.5.14, but version 8.5.78 already contains the upstream fix. Commit 29893e66111d33cfe99dd01cb146317c0c262ef4 (authored by Mark Thomas on May 2, 2017) added DispatcherType.ERROR checks in both DefaultServlet and WebdavServlet service() methods, forcing all error dispatches to be processed via doGet() regardless of the original HTTP method. This fix was shipped in the upstream Apache Tomcat 8.5.78 release and was present when TuxCare onboarded the version (commit fb98844404). The vulnerable pattern (allowing write methods like PUT/DELETE to execute on static error pages during error dispatch) no longer exists in the codebase.", "justification": "code_not_present" } }, { "id": "CVE-2017-7674", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:78a8186c-704b-5bf8-9443-2e2af4742580", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-7674 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 The target (Apache Tomcat 8.5.78) is not affected by CVE-2017-7674. The vulnerability (missing Vary header in CORS Filter responses leading to cache poisoning) was fixed in upstream Apache Tomcat 8.5.16 (May 2017) via commit 9044c1672b, and further refined in commit d8db00eb64 (July 2018). Both fixes were already present in the upstream 8.5.78 release that TuxCare onboarded (commit fb98844404)....", "justification": "code_not_present" } }, { "id": "CVE-2017-7675", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:279fdc8c-454d-5260-a505-988c2a56f426", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-7675 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat. Apache Tomcat 8.5.78 is NOT affected by CVE-2017-7675. The vulnerability (bypassing security constraints via path parameter stripping in HTTP/2 requests) was fixed in upstream Apache Tomcat by commit dacb030b85 on May 24, 2017. This fix was already present in the upstream Apache Tomcat 8.5.78 release that TuxCare onboarded in September 2026. The fix changes HTTP/2 `:path` header processing in Stream.java to set the URI as bytes (preserving path parameters) instead of as String (which stripped them), ensuring downstream security checks receive the complete path.", "justification": "code_not_present" } }, { "id": "CVE-2019-0221", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:048e9ac1-e9ee-5b45-9159-c40042df46ee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-0221 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2019-17569", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:48ae3323-2590-5690-a61d-d6ec12a40569", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17569 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2020-11996", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:cc1abe32-fcb6-595a-9d01-faea80c0f89c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-11996 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat. CVE-2020-11996 affects Apache Tomcat 8.5.0 to 8.5.55. The target repository is version 8.5.78, which contains the upstream fix committed by Mark Thomas (markt@apache.org) in May-September 2020. The vulnerable code pattern - a loop iterating through numeric stream ID ranges - has been replaced with iteration over actual existing streams using ConcurrentNavigableMap.subMap(). This prevents CPU exhaustion when processing HTTP/2 requests with large stream ID gaps. The fix was present in upstream tag 8.5.56 and was already included when TuxCare onboarded version 8.5.78.", "justification": "code_not_present" } }, { "id": "CVE-2020-13934", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:4a3e7c44-a9b5-5541-85f2-40f40d7377ce", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-13934 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat. Target version 8.5.78 is not affected by CVE-2020-13934. The vulnerability (failure to release HTTP/1.1 processor after h2c upgrade leading to memory exhaustion) was fixed in upstream Apache Tomcat by commit 923d834500 authored by Mark Thomas (markt@apache.org). This fix was included in the upstream 8.5.78 release, which is newer than the last affected version (8.5.56). The target repository contains the complete fix: the HTTP/1.1 processor is properly released via `release(processor)` before creating the HTTP/2 upgrade processor, and the control flow correctly uses `state = SocketState.CLOSED` to trigger cleanup.", "justification": "code_not_present" } }, { "id": "CVE-2020-13935", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:c838e1e3-75a5-59c2-a73f-f0659853e057", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-13935 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2020-1935", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:cb66819d-a1da-50ed-b959-954c0a801357", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-1935 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2020-8022", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:45b1c0f9-44d8-5be0-8a94-f51125d7e80b", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2020-8022 is a false positive for org.apache.tomcat:tomcat 8.5.78-tuxcare.2." } }, { "id": "CVE-2021-30639", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:2c984bbf-9866-5813-b93f-84b8f5598aeb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-30639 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2021-30640", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:6a8e6f6c-d2c0-5b4f-9a55-cb38bb813190", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-30640 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2021-33037", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:b30ab94d-a46e-5030-922a-8dd101479962", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-33037 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2021-33037 does not affect Tomcat 8.5.78. The vulnerability affected versions 8.5.0 to 8.5.66. Apache Tomcat fixed this issue in May 2021 (commits 19d11556d0, eee0d024, and 506134f9), and the fixes were included in upstream release 8.5.67 and later. The target version 8.5.78 already contains all three required fixes: (1) rejects \"identity\" transfer encoding with 501 response, (2) processes ...", "justification": "code_not_present" } }, { "id": "CVE-2021-41079", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:3eb420e4-9d0c-576c-84f1-489a45849472", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-41079 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2021-42340", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:5c6846ba-ac05-5734-a1fe-1ec573c9f488", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-42340 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat. Target version 8.5.78 is NOT vulnerable to CVE-2021-42340. The fix for the WebSocket memory leak was already included in the upstream Apache Tomcat 8.5.78 release (March 2022) before TuxCare onboarded this version. The vulnerable pattern (failure to close WebConnection objects in WsHttpUpgradeHandler) is not present in the target code.", "justification": "code_not_present" } }, { "id": "CVE-2021-43980", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:02e21acd-4b2d-59a9-bdfc-e937d24acf9c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-43980 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 Target version 8.5.78 is NOT affected by CVE-2021-43980. The CVE explicitly states affected versions are \"8.5.0 to 8.5.77\" - version 8.5.78 is excluded. The upstream fix (commit 4a00b0c0890538b9d by Mark Thomas on 2022-03-29) was included in Tomcat 8.5.78 release (2022-04-01), which TuxCare onboarded with the fix already present. The vulnerable pattern (non-atomic processor ownership allowing c...", "justification": "code_not_present" } }, { "id": "CVE-2022-23181", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:cc9c64f3-0c04-53a4-afbc-0971bfa30f31", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-23181 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2022-25762", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:c6930426-d6dd-546f-85fa-445b46227c1a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-25762 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2022-29885", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:7e99aea9-95d5-50a5-a581-c88dbf3f1ce1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-29885 is fixed in version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2022-34305", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:3ad2f3b2-0533-59ed-bc7c-6ff4fdcdf441", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-34305 is fixed in version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2023-41080", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:5a325ecb-5deb-50ba-852a-0d1ff8083e01", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-41080 is fixed in version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2023-42795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:fcde4da7-b944-508b-b31e-602568cdff9d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-42795 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2023-45648", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:3baae0f0-245c-5da5-b86d-bbc9839847cb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-45648 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2024-54677", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:5bf87511-e76c-5f26-9455-52297baca2ed", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-54677 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2025-49124", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:581ebf69-ef4d-5cd6-89a9-d623887c9c47", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49124 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2025-55752", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:efb3434c-009b-5daf-9f8d-56103d791de7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-55752 is fixed in version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2025-55754", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:b00da252-e126-55ff-a3e8-b3af64a11c1b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-55754 is fixed in version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2025-61795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:986f438d-c56c-5ea7-af5a-05aedd261878", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-61795 is fixed in version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2025-66614", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:916f66d7-2421-5245-85e9-2cad1813e570", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66614 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-25854", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:73015e5c-1138-5952-99d2-cd687a6cb74d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25854 is fixed in version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-29129", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:c9dda3d2-533f-583f-bc5a-dd9afc3e8d6c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-29129 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-29145", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:f3b696a1-618a-572b-a1a7-4204fabe8207", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-29145 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-29146", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:ac58a330-a01b-517d-80bf-63d5a5e4726c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29146 is fixed in version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-32990", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:d1f71d0e-a58a-5e52-a081-f57fac3caa65", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-32990 does not affect version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat. not_affected \u2014 Apache Tomcat 8.5.78 is not affected by CVE-2026-32990. The vulnerability requires the checkSni() method introduced in CVE-2025-66614, which was backported to version 8.5.100. Version 8.5.78 predates this feature and lacks the vulnerable code path entirely. The SNI validation framework that compares protocol hostname with SNI hostname does not exist in 8.5.78.", "justification": "code_not_present" } }, { "id": "CVE-2026-34483", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:65a1929e-f6bb-5117-b353-13527de52f06", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34483 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-34486", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:70e2568e-fb5a-5f15-b93d-5b190d9924c0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34486 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-34487", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:7d967a59-5bed-55b6-951e-b54f405a8908", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34487 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-41284", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:e1a52e9c-7157-5359-a87d-f2b58ca70896", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41284 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-41293", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:16bcf2d7-794b-504a-ba3f-cef5b957c5d8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41293 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-42498", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:37762e67-39e5-5e58-af4f-57a3276fa739", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42498 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-43512", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:aea70804-8479-5f5f-96ad-02c4f2ff9c1c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43512 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-43513", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:c442408d-d305-5dd9-a0ab-611ab0cea4c9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43513 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-43514", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:2d164229-5c85-53a9-9fd0-c1c3ce43b63e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43514 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-43515", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:cd7ee450-f6af-571c-92e0-3d6cecef96f0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43515 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-65182", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:aff5ce3f-039e-510a-b0c1-c8fa75da08a5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65182 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-65905", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:05ec81f5-47a4-52c0-b5be-24d71e4a2b62", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65905 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-68525", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.2" } ], "bom-ref": "urn:uuid:442dcd04-b888-5791-9cd9-1c0817e9c8d3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-68525 affects version 8.5.78-tuxcare.2 of org.apache.tomcat:tomcat." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.2" } ] }