{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:0f950b0a-0e9f-5bec-b360-5faec6df0bf8", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat-catalina", "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.46-tuxcare.3", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.46-tuxcare.3", "version": "8.5.46-tuxcare.3", "pedigree": { "ancestors": [ { "name": "tomcat-catalina", "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.46", "type": "library", "group": "org.apache.tomcat", "version": "8.5.46" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-5388", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.46-tuxcare.3" } ], "bom-ref": "urn:uuid:75fa2b2b-ad9f-505a-abf5-217f044c8b41", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-5388 does not affect version 8.5.46-tuxcare.3 of org.apache.tomcat:tomcat-catalina. CVE-2016-5388 (httpoxy) is NOT present in Tomcat 8.5.46. The vulnerability affected Tomcat 8.x through 8.5.4, and the fix was included in the upstream Apache Tomcat 8.5.46 release. The target contains the upstream fix (commit 1b91e91194) authored by Mark Thomas, which replaced the vulnerable blacklist approach (blocking only AUTHORIZATION/PROXY_AUTHORIZATION headers) with a whitelist regex pattern that prevents the \"Proxy\" HTTP header from being passed to CGI processes as the HTTP_PROXY environment variable. This fix was already present when TuxCare onboarded version 8.5.46.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.0.0, < 7.0.72; >= 8.0.0, < 8.5.5), NVD (>= 6.0, <= 6.0.45; >= 7.0, <= 7.0.70; >= 8.0, <= 8.5.4), Snyk (>= 7.35, < 8.5.5; >= 7.35, < 8.5.5).", "justification": "code_not_present" } }, { "id": "CVE-2016-8735", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.46-tuxcare.3" } ], "bom-ref": "urn:uuid:ac4f609f-5c43-5c35-9c42-07c8fdd27fcf", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-8735 does not affect version 8.5.46-tuxcare.3 of org.apache.tomcat:tomcat-catalina. Target Apache Tomcat 8.5.46 is NOT affected by CVE-2016-8735. The fix for this vulnerability was included in the upstream Apache Tomcat 8.5.46 release (CVE states \"8.5.x before 8.5.7\" affected; 8.5.46 > 8.5.7). Both required security patches are present: (1) credential type restriction limiting deserialization to String[] and String only (lines 268-270), and (2) server.toStub() binding (line 324). The fix commit 292d6ccdc9 by markt@apache.org predates TuxCare's onboarding of version 8.5.46, confirming this is an upstream fix that shipped in the release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 6.0.48; >= 7.0.0, < 7.0.73; >= 8.0.0, < 8.0.39; >= 8.5.0, < 8.5.7; >= 9.0.0.M1, < 9.0.0.M12; < 6.0.48; >= 7.0.0, < 7.0.73; >= 8.0.0, < 8.0.39; >= 8.5.0, < 8.5.7; >= 9.0.0.M1, < 9.0.0.M12), NVD (< 6.0.48; >= 7.0.0, < 7.0.73; >= 8.0, < 8.0.39; >= 8.5.0, < 8.5.7; = 9.0.0; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (< 6.0.48; >= 7, < 7.0.73; >= 8, < 8.0.39; >= 8.5, < 8.5.7; >= 9, < 9.0.0.M12), Snyk (>= 6, < 6.0.48; >= 7.0.0, < 7.0.73; >= 8, < 8.0.39; >= 8.5.0, < 8.5.8; >= 9-alpha, < 9.0.0.M13).", "justification": "code_not_present" } }, { "id": "CVE-2017-12616", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.46-tuxcare.3" } ], "bom-ref": "urn:uuid:6831ace5-c8a2-5d97-9c71-ed4f3c32f1c5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-12616 does not affect version 8.5.46-tuxcare.3 of org.apache.tomcat:tomcat-catalina. CVE-2017-12616 affects VirtualDirContext in Tomcat 7.0.0-7.0.80, which allowed directory traversal via missing canonical path validation. Tomcat 8.5.46 does not contain VirtualDirContext\u2014it was replaced by the WebResourceRoot architecture (DirResourceSet, FileResourceSet) in Tomcat 8.0. The replacement includes canonical path validation in AbstractFileResourceSet.file() (lines 98-100) that blocks directory traversal. This defense was present in the upstream 8.5.46 release, confirmed by examining the upstream tag. All request-handling code paths use the validated file() method. Type B analysis: target processes virtual directory resources but runtime defense prevents exploitation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.0.0, < 7.0.81), NVD (= 7.0.0; = 7.0.0-beta; = 7.0.1; = 7.0.2; = 7.0.2-beta; = 7.0.3; = 7.0.4; = 7.0.4-beta; = 7.0.5; = 7.0.5-beta; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 7.0.76; = 7.0.77; = 7.0.79; = 7.0.80), cve.org (>= 7.0.0, <= 7.0.80), Snyk (>= 7.0.0, < 7.0.81).", "justification": "protected_at_runtime" } }, { "id": "CVE-2017-12617", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.46-tuxcare.3" } ], "bom-ref": "urn:uuid:694df127-3ba4-5d18-8b06-4715f8329798", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-12617 does not affect version 8.5.46-tuxcare.3 of org.apache.tomcat:tomcat-catalina. Target is pristine upstream Apache Tomcat 8.5.46 (HEAD detached at tag 8.5.46, SHA 914f68b451). CVE-2017-12617 is a JSP-upload RCE: with the Default/WebDAV servlet's readonly init-param set to false, an attacker could PUT a JSP whose target path carries a trailing slash (e.g. `PUT /evil.jsp/`) so it bypasses the `*.jsp`\u2192JspServlet mapping and is written by the DefaultServlet as `evil.jsp` (the File API drops the trailing '/'); a later `GET /evil.jsp` executes it. The upstream remainder-of-fix (apache/tomcat commit 4cf7dab8, Mark Thomas, bug 61542) is present: DirResourceSet.write() rejects any path ending in '/' before creating the file (lines 220-224: `if (path.endsWith(\"/\")) return false;`). DirResourceSet is the sole writable resource set reachable from DefaultServlet.doPut \u2192 StandardRoot.write \u2192 main.write; FileResourceSet.write and EmptyResourceSet.write unconditionally return false. AbstractFileResourceSet.file() additionally enforces canonical-path/case-sensitivity and Windows-filename checks (lines 65, 83, 130). Fix commit (one of the supplied patch URLs) is an upstream, Apache-authored change baked into the 8.5.46 release \u2014 not vulnerable. Verdict: not_affected (upstream fix present; vulnerable pattern absent from HEAD).", "justification": "code_not_present" } }, { "id": "CVE-2017-5648", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.46-tuxcare.3" } ], "bom-ref": "urn:uuid:42f5acfb-092f-55a5-a69d-08c2b5f10c78", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-5648 does not affect version 8.5.46-tuxcare.3 of org.apache.tomcat:tomcat-catalina. CVE-2017-5648: Tomcat fired request lifecycle events (requestInitialized/requestDestroyed) to application listeners using the raw internal org.apache.catalina.connector.Request object instead of its facade. Under a SecurityManager, an untrusted webapp's listener could retain that reference and reach another webapp's request/response data. Affected: 8.5.0\u20138.5.11; fixed in 8.5.12. Target is 8.5.46. The upstream tc8.5.x fix commit 0f7b9465 (\"Ensure request and response facades are used when firing application listeners\", Mark Thomas, svn r1785775) is an ancestor of HEAD, and all patched call sites now pass the facade: StandardHostValve.java:125/181, AsyncContextImpl.java:112, and FormAuthenticator.java:430/432/476/478 all use context.fireRequestInitEvent/DestroyEvent(request.getRequest()). The vulnerable pre-fix pattern (passing raw `request`) is absent from HEAD. The only remaining raw-`request` callers (ApplicationDispatcher.java:458/476) were intentionally left unchanged upstream because that `request` is the application-facing ServletRequest argument of the public RequestDispatcher.forward/include API \u2014 already a facade/wrapper, never the internal connector.Request. Fix is upstream-authored (apache.org), not a TuxCare backport, so verdict is not_affected / code_not_present rather than already_fixed.", "justification": "code_not_present" } }, { "id": "CVE-2019-0221", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.46-tuxcare.3" } ], "bom-ref": "urn:uuid:c1ecff52-5310-5365-bc08-0bffa84cc0d6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-0221 does not affect version 8.5.46-tuxcare.3 of org.apache.tomcat:tomcat-catalina. not_affected \u2014 Apache Tomcat 8.5.46 is not affected by CVE-2019-0221. The XSS vulnerability in the SSI printenv command was fixed in upstream commit 4fcdf706f3 (by Mark Thomas on 2019-03-11) and was included in the Apache Tomcat 8.5.46 release (2019-09-19) before TuxCare onboarded the version. The target code at java/org/apache/catalina/ssi/SSIPrintenv.java:44 applies HTML entity encoding via getVariableValue...", "justification": "code_not_present" } }, { "id": "CVE-2019-2684", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.46-tuxcare.3" } ], "bom-ref": "urn:uuid:2dafa660-3db4-5015-a21f-41a54c7fe720", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-2684 does not affect version 8.5.46-tuxcare.3 of org.apache.tomcat:tomcat-catalina. not_affected \u2014 Tomcat 8.5.46 contains vulnerable JMX/RMI code that could expose CVE-2019-2684 (Java SE RMI deserialization), but this code is not reachable in the default shipped configuration. The vulnerable JmxRemoteLifecycleListener class exists in the codebase and uses the unpatched `LocateRegistry.createRegistry()` + `registry.bind()` pattern that allows unauthorized RMI registry modifications. However, ...", "justification": "code_not_reachable" } }, { "id": "CVE-2020-9484", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.46-tuxcare.3" } ], "bom-ref": "urn:uuid:3a322d44-62bb-5b87-a6bc-79187f670d66", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-9484 affects version 8.5.46-tuxcare.3 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2022-45143", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.46-tuxcare.3" } ], "bom-ref": "urn:uuid:5c1ceb10-2e19-542c-baad-264dee164241", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-45143 does not affect version 8.5.46-tuxcare.3 of org.apache.tomcat:tomcat-catalina. Tomcat 8.5.46 is not affected by CVE-2022-45143. The vulnerable component JsonErrorReportValve does not exist in this version - it was introduced later in version 8.5.83. Version 8.5.46 only has ErrorReportValve which produces HTML error pages, not JSON. The CVE correctly identifies 8.5.83 as the first affected version in the 8.5.x series. No JSON error reporting capability exists in 8.5.46, therefore the vulnerability pattern (unescaped user-controlled values in JSON output) cannot occur.", "justification": "code_not_present" } }, { "id": "CVE-2023-24998", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.46-tuxcare.3" } ], "bom-ref": "urn:uuid:3a8ed2a3-758a-5c68-ac70-daa221ffdb2a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-24998 affects version 8.5.46-tuxcare.3 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2023-28708", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.46-tuxcare.3" } ], "bom-ref": "urn:uuid:25316aa8-b987-5810-a774-31f575387ce2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-28708 is fixed in version 8.5.46-tuxcare.3 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2023-41080", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.46-tuxcare.3" } ], "bom-ref": "urn:uuid:f6100807-53a9-5fc9-932f-b4aa33fdc8cd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-41080 is fixed in version 8.5.46-tuxcare.3 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2023-42795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.46-tuxcare.3" } ], "bom-ref": "urn:uuid:5ecf0eca-08b5-5ee6-8375-30e22bbc4764", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-42795 affects version 8.5.46-tuxcare.3 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2023-46589", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.46-tuxcare.3" } ], "bom-ref": "urn:uuid:c0d132fc-274b-5cd4-844a-fc944c7403f4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-46589 is fixed in version 8.5.46-tuxcare.3 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2024-50379", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.46-tuxcare.3" } ], "bom-ref": "urn:uuid:7e1c86c0-bb82-5efe-8ec9-a908f58e41da", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-50379 affects version 8.5.46-tuxcare.3 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2024-52316", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.46-tuxcare.3" } ], "bom-ref": "urn:uuid:c047433a-50ab-59bb-a8ae-fda5ecd64863", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-52316 affects version 8.5.46-tuxcare.3 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2024-56337", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.46-tuxcare.3" } ], "bom-ref": "urn:uuid:7817d37a-2188-5c11-a1bd-6def57f22007", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-56337 affects version 8.5.46-tuxcare.3 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-24813", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.46-tuxcare.3" } ], "bom-ref": "urn:uuid:bd8df27d-9282-5efe-88ac-1385368b7f6f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-24813 is fixed in version 8.5.46-tuxcare.3 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-31651", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.46-tuxcare.3" } ], "bom-ref": "urn:uuid:4df08183-54cb-53d2-9910-5bbc7746dc16", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31651 affects version 8.5.46-tuxcare.3 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-46701", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.46-tuxcare.3" } ], "bom-ref": "urn:uuid:9029f014-d13c-5e43-8cfc-031eca6e5df4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-46701 is fixed in version 8.5.46-tuxcare.3 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-48988", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.46-tuxcare.3" } ], "bom-ref": "urn:uuid:fac5e1ed-f914-5dcb-bf2b-bd6cff5fe6c2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48988 is fixed in version 8.5.46-tuxcare.3 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-49124", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.46-tuxcare.3" } ], "bom-ref": "urn:uuid:19493c52-7fbc-5a5f-b075-dfeb0e377843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49124 affects version 8.5.46-tuxcare.3 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-49125", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.46-tuxcare.3" } ], "bom-ref": "urn:uuid:7fdaa0bf-689c-5370-9d92-96b9b48a86c6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-49125 is fixed in version 8.5.46-tuxcare.3 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-52520", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.46-tuxcare.3" } ], "bom-ref": "urn:uuid:0d11b897-9afa-5810-b411-f29bdcf9e885", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-52520 affects version 8.5.46-tuxcare.3 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-55668", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.46-tuxcare.3" } ], "bom-ref": "urn:uuid:a2237b0e-08c1-5908-b035-9ab437208acf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55668 affects version 8.5.46-tuxcare.3 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-55752", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.46-tuxcare.3" } ], "bom-ref": "urn:uuid:4d38dd4f-6929-5b7a-89e6-e967c9c6a6f5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-55752 is fixed in version 8.5.46-tuxcare.3 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-55754", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.46-tuxcare.3" } ], "bom-ref": "urn:uuid:db5d3a55-7cda-58a9-8e02-37923e291aeb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55754 affects version 8.5.46-tuxcare.3 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-61795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.46-tuxcare.3" } ], "bom-ref": "urn:uuid:84fd52ea-13e0-5edc-af14-3d033d3f6ba2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-61795 is fixed in version 8.5.46-tuxcare.3 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-25854", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.46-tuxcare.3" } ], "bom-ref": "urn:uuid:3f3243da-e2f3-53cb-957f-8813330fcb01", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25854 is fixed in version 8.5.46-tuxcare.3 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-34483", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.46-tuxcare.3" } ], "bom-ref": "urn:uuid:11b72b6c-8a29-54af-a380-8b7e3aa26b6f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-34483 does not affect version 8.5.46-tuxcare.3 of org.apache.tomcat:tomcat-catalina. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. The CNA identifies incomplete escaping in JsonAccessLogValve and explicitly marks versions through 8.5.83 unaffected; its affected 8.5 range starts at 8.5.84 (CVE:1). HEAD contains no tracked JsonAccessLogValve or JSON access-log wrapper, and the configured logger is AccessLogValve using the common text pattern (server.xml:160). The shared URI/query append sites do exist, and the genuine fix\u2019s escaping calls are absent (AbstractAccessLogValve.java:1146, AbstractAccessLogValve.java:1350, AbstractAccessLogValve.java:1383, fix:19). Their actual consumer concatenates pattern elements and writes the resulting text followed by a newline, without the CVE\u2019s JSON wrapper (AbstractAccessLogValve.java:706, AccessLogValve.java:615).", "justification": "code_not_present" } }, { "id": "CVE-2026-41284", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.46-tuxcare.3" } ], "bom-ref": "urn:uuid:ae33dcaa-1357-54d9-981a-954eaa73773d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41284 affects version 8.5.46-tuxcare.3 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-42498", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.46-tuxcare.3" } ], "bom-ref": "urn:uuid:80ca123e-95b5-520b-8d4f-ce2e9048dddd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42498 affects version 8.5.46-tuxcare.3 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-43512", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.46-tuxcare.3" } ], "bom-ref": "urn:uuid:260ae9b0-87d0-5ca3-836c-2fbf57ea0e83", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43512 affects version 8.5.46-tuxcare.3 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-43513", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.46-tuxcare.3" } ], "bom-ref": "urn:uuid:ec0612f6-9dcc-5cb1-9f0b-469ad816fcad", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43513 affects version 8.5.46-tuxcare.3 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-43514", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.46-tuxcare.3" } ], "bom-ref": "urn:uuid:9bc037f8-9768-534b-b4bc-9398917d4e36", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43514 affects version 8.5.46-tuxcare.3 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-43515", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.46-tuxcare.3" } ], "bom-ref": "urn:uuid:b86becd7-7bf4-5427-9693-8bbc75b82968", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43515 affects version 8.5.46-tuxcare.3 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-53404", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.46-tuxcare.3" } ], "bom-ref": "urn:uuid:7c41731c-03f8-53b3-9316-ebb8282059ce", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53404 affects version 8.5.46-tuxcare.3 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-55956", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.46-tuxcare.3" } ], "bom-ref": "urn:uuid:03660164-6dee-5cb8-ad15-21c2338d50a7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-55956 affects version 8.5.46-tuxcare.3 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-55957", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.46-tuxcare.3" } ], "bom-ref": "urn:uuid:2eec7966-c9e0-5376-97ea-6182bd561155", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-55957 affects version 8.5.46-tuxcare.3 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-65182", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.46-tuxcare.3" } ], "bom-ref": "urn:uuid:2135219d-8348-5edc-bac1-5e4b4839cb19", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65182 affects version 8.5.46-tuxcare.3 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-65905", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.46-tuxcare.3" } ], "bom-ref": "urn:uuid:696eb7d4-ea0a-5a68-9e0c-05f915c041f5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65905 affects version 8.5.46-tuxcare.3 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-68525", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.46-tuxcare.3" } ], "bom-ref": "urn:uuid:e85444f3-9378-599c-9b74-009c37969052", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-68525 affects version 8.5.46-tuxcare.3 of org.apache.tomcat:tomcat-catalina." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.46-tuxcare.3" } ] }