{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:b7224dc0-aecc-5289-bb73-1b2548acecf9", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat", "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1", "version": "9.0.24-tuxcare.1", "pedigree": { "ancestors": [ { "name": "tomcat", "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.24", "type": "library", "group": "org.apache.tomcat", "version": "9.0.24" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2008-1947", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:8af4b462-a96f-580a-a9be-eda8eec89cdc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2008-1947 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2013-4590", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:d8e27368-12c7-5bcc-b1ce-02e40be8b885", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2013-4590 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2015-5174", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:a850cd78-6e9d-5d01-aa14-b0e55056924c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5174 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2015-5346", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:ca483b42-b059-5ead-81ff-42db8687fefd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5346 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2016-0706", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:8fc91128-e05e-5ce9-bb78-4734eeffea0e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-0706 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2016-0762", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:13c098e1-a365-519a-bc33-8d8f6a90a9dc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-0762 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2016-0763", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:761d9799-bb7e-5d6b-bd0a-752d098c7739", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-0763 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2016-6794", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:06db03bb-594a-597a-a53d-98d41e826df4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-6794 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2016-6796", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:41ad87a0-3c45-5d52-b685-9b109988560c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-6796 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2016-6797", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:02bfcafb-800e-5cc5-9910-e0636e583f68", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-6797 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2016-6817", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:73cbb204-bc55-5a62-9261-b2346528b719", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-6817 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2016-8747", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:6216ccc9-a607-5a51-a53c-8e6a635a1bb2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-8747 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2017-5647", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:4c74d072-b078-57c4-b319-c63b6b468aab", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-5647 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2017-5650", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:2aa5586a-ac18-5ac4-9709-3f5eb9a4ec3d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-5650 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2017-5664", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:421bd9c8-79fb-5be1-90c3-3a971abc185a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-5664 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2017-7674", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:57fcd3d4-e137-5b24-8cd6-d835b52850af", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7674 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2017-7675", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:0ccad81b-9b00-5886-8c8a-273fd728c695", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7675 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2019-0221", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:24789311-448d-51bf-a4af-839c5343f512", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-0221 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2019-17569", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:de29d521-6884-5c4c-953d-bb2701a59e6c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17569 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2020-11996", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:1c8b6075-2e2a-540f-a9a6-66f809d0c487", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-11996 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2020-13934", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:e21c00e8-d5c3-5c02-a5d8-ffb2208605d5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-13934 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2020-13935", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:0a5867a9-674b-5866-8a56-fcd73ff0094c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-13935 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2020-1935", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:84e93625-2ecc-5f18-aa64-4b953fd2d171", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-1935 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2020-8022", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:8b10ca21-9d06-5fdc-9af4-ce67ba3e3240", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2020-8022 is a false positive for org.apache.tomcat:tomcat 9.0.24-tuxcare.1." } }, { "id": "CVE-2021-30639", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:e1dac3ec-302f-5541-b088-2f5478407ede", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-30639 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat. Apache Tomcat 9.0.24 is not affected by CVE-2021-30639. This vulnerability was introduced as a regression in later versions (9.0.44, 8.5.64, 10.0.3-10.0.4) when commit 3082475acb on the 9.0.x line (0a11905b67 on 8.5.x) added an errorException field for improved non-blocking I/O error handling but failed to reset it in the recycle() method. Version 9.0.24 predates this change and does not contain the errorException field, making the vulnerability pattern impossible to manifest.", "justification": "code_not_present" } }, { "id": "CVE-2021-30640", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:a9f4fc6b-700c-5a86-b9a8-f1e630ce1643", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-30640 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2021-33037", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:37ba618e-d51b-5144-9ffb-63efce660176", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-33037 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2021-41079", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:25cd2eb6-aacd-50cb-828b-d10409b22864", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-41079 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2021-42340", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:827eea57-f042-5bad-b03c-cadaae6e064a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-42340 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat. Version 9.0.24 is not affected by CVE-2021-42340. The vulnerability was introduced by the bug 63362 fix in October 2020 (affecting versions 9.0.40+), which added the UpgradeInfo object for metrics collection. Version 9.0.24 (released August 2019) predates this change and does not contain UpgradeInfo, therefore the vulnerable pattern does not exist in this version.", "justification": "code_not_present" } }, { "id": "CVE-2021-43980", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:e7ce7282-f2f3-5409-a7e9-bce3788e869a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-43980 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat. not_affected \u2014 Tomcat 9.0.24 is NOT AFFECTED by CVE-2021-43980. The CVE states \"The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9.0.47 onwards exposed a long standing concurrency bug.\" Version 9.0.24 predates this architectural change (9.0.47) and uses the older ConcurrentHashMap-based processor management instead of the vulnerable currentProcessor ...", "justification": "code_not_present" } }, { "id": "CVE-2022-23181", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:f9734c44-c23f-59aa-bd58-4b00291b75b3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-23181 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2022-25762", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:a9672d24-e54c-5853-be38-5fccbfbee161", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-25762 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2022-29885", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:3ebfe83d-fad9-5280-b610-76293d4dc355", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-29885 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2022-34305", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:1980231e-59db-5eed-ae6d-47d1d1cb1959", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-34305 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat. not_affected \u2014 Version 9.0.24 is not affected by CVE-2022-34305. The vulnerable code (unfiltered display of session and principal attributes in HTML tables) was added in commit 4666a36eb6 on 2019-11-28, more than 3 months after version 9.0.24 was tagged on 2019-08-14. The file `/webapps/examples/jsp/security/protected/index.jsp` in version 9.0.24 has only 82 lines and does not contain the code that iterates o...", "justification": "code_not_present" } }, { "id": "CVE-2023-41080", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:0c8ac30b-8ec5-5c25-8f7d-4e68dff214ed", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-41080 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2023-42795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:f9575026-ffca-5f52-b00c-23bfdad9172c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-42795 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2023-45648", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:da57191e-aba1-524f-9441-7822062c2d65", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-45648 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2024-54677", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:f98d7781-92c0-5d50-a069-295ca3882860", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-54677 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2025-49124", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:f37a7514-a13d-5579-b4e4-676942cf3990", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-49124 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2025-55752", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:db53107e-1b35-5dd6-bef3-b0e8dbae71c3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-55752 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2025-55754", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:e4cca9ec-80a8-50bc-bf4b-7b0c8376cef2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55754 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2025-61795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:950c95ad-c607-5a9f-a337-71a76df9925b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-61795 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2025-66614", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:5edbbf23-32d0-59ff-afac-7ae32bde8be6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66614 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-25854", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:4b97171d-ece0-5e71-92da-3d88097a37f2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25854 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-29129", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:6afe7508-c07c-5dd7-9326-b59780ced524", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-29129 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-29145", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:63741418-33b6-541d-9a37-424b7647a36d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-29145 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-29146", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:3a1986fc-b71e-51ba-85ba-ff9dd0d323b4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29146 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-32990", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:2fa516d4-72b6-5cf4-b5c6-d533066a77f5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-32990 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2026-32990 affects the checkSni() method in AbstractEndpoint.java, which validates SNI hostnames against protocol-level host headers. This method was introduced by CVE-2025-66614 in Tomcat versions 9.0.113+, 10.1.50+, and 11.0.15+. The current target (version 9.0.24) predates this feature entirely - the checkSni() method, strictSni configuration, and SNI-vs-protocol-hostname validation logi...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-34483", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:48797043-9289-59c9-b020-3a124e6bd97d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34483 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-34486", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:ef8329f4-0a49-528e-9d34-0737a3248a61", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34486 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-34487", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:6bd4f155-e879-5760-83b5-67c9d3c46a2b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34487 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-41284", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:44552a31-a293-5e08-bad9-8684505edf62", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41284 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-41293", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:8752bc85-2b90-52ff-bc40-121b34649092", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41293 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-42498", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:aae7475e-c77f-5c7e-83d8-adc203776cdc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42498 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-43512", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:5f9cf462-100d-5557-b8fd-564dd4506576", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43512 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-43513", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:724d8cd4-60d3-579b-87a1-5d2efe0fb335", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43513 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-43514", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:b9bb764f-67cb-56bf-96ff-d517dba6264a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43514 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-43515", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:788604e0-dd6b-50a2-bbd5-2688c2d2db1d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43515 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-65182", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:da71b7a9-69b6-59be-a3e0-c926341b0a36", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65182 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-65905", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:a376fd0e-f67e-573b-815c-ad2a7d4524a0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65905 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-68525", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:f3bc00a4-3273-5d32-8680-360785b725e8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-68525 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.24-tuxcare.1" } ] }