{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:5cab6b49-a0d2-5671-a868-7cfcc8f0bf26", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat-catalina", "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.78-tuxcare.4", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.78-tuxcare.4", "version": "8.5.78-tuxcare.4", "pedigree": { "ancestors": [ { "name": "tomcat-catalina", "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.78", "type": "library", "group": "org.apache.tomcat", "version": "8.5.78" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-5388", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.78-tuxcare.4" } ], "bom-ref": "urn:uuid:aec63920-97e1-548d-812f-3d2dcc965bbd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-5388 does not affect version 8.5.78-tuxcare.4 of org.apache.tomcat:tomcat-catalina. Apache Tomcat 8.5.78-tuxcare.3 is not affected by CVE-2016-5388 (httpoxy). The vulnerability allowed attackers to control the HTTP_PROXY environment variable in CGI processes by sending a crafted \"Proxy\" HTTP header. The fix (commit 1b91e91194 by Mark Thomas, August 2016) replaced the vulnerable blacklist approach with a whitelist-based header filtering mechanism using the envHttpHeadersPattern regex. This fix was already present in the upstream Apache Tomcat 8.5.78 release (March 2022) when TuxCare onboarded it, as confirmed by ancestry analysis showing the fix commit predates the first TuxCare commit (fb98844404) by approximately 6 years. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.0.0, < 7.0.72; >= 8.0.0, < 8.5.5), NVD (>= 6.0, <= 6.0.45; >= 7.0, <= 7.0.70; >= 8.0, <= 8.5.4), Snyk (>= 7.35, < 8.5.5; >= 7.35, < 8.5.5).", "justification": "code_not_present" } }, { "id": "CVE-2016-8735", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.78-tuxcare.4" } ], "bom-ref": "urn:uuid:39c5f0dc-369f-565b-b756-af494cd89abc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-8735 does not affect version 8.5.78-tuxcare.4 of org.apache.tomcat:tomcat-catalina. CVE-2016-8735 affects the JmxRemoteLifecycleListener component, which was completely removed from Apache Tomcat 8.5.78 in the upstream release. The component was originally patched in November 2016 to restrict credential deserialization types, then deprecated because its functionality became available in the JRE, and finally removed in January 2022 (commit 1b9e8fd1f4 by upstream Apache developer Mark Thomas). Since the vulnerable component does not exist in version 8.5.78, the target is not affected by this CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 6.0.48; >= 7.0.0, < 7.0.73; >= 8.0.0, < 8.0.39; >= 8.5.0, < 8.5.7; >= 9.0.0.M1, < 9.0.0.M12), NVD (< 6.0.48; >= 7.0.0, < 7.0.73; >= 8.0, < 8.0.39; >= 8.5.0, < 8.5.7; = 9.0.0; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (< 6.0.48; >= 7, < 7.0.73; >= 8, < 8.0.39; >= 8.5, < 8.5.7; >= 9, < 9.0.0.M12).", "justification": "code_not_present" } }, { "id": "CVE-2017-12616", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.78-tuxcare.4" } ], "bom-ref": "urn:uuid:4d8696b6-9e4b-5dbf-bf62-3a0189f0d769", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-12616 does not affect version 8.5.78-tuxcare.4 of org.apache.tomcat:tomcat-catalina. Tomcat 8.5.78 is not affected by CVE-2017-12616. The vulnerable VirtualDirContext class does not exist in Tomcat 8; it was replaced by a new ResourceSet architecture in October 2012 (5 years before the CVE) that includes proper canonical path validation from inception. The upstream architectural redesign that eliminated the vulnerability was already present in the 8.5.78 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.0.0, < 7.0.81), NVD (= 7.0.0; = 7.0.0-beta; = 7.0.1; = 7.0.2; = 7.0.2-beta; = 7.0.3; = 7.0.4; = 7.0.4-beta; = 7.0.5; = 7.0.5-beta; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 7.0.76; = 7.0.77; = 7.0.79; = 7.0.80), cve.org (>= 7.0.0, <= 7.0.80), Snyk (>= 7.0.0, < 7.0.81).", "justification": "code_not_present" } }, { "id": "CVE-2017-12617", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.78-tuxcare.4" } ], "bom-ref": "urn:uuid:c31c1ebf-9d1f-515d-b416-64ec12684c5c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-12617 does not affect version 8.5.78-tuxcare.4 of org.apache.tomcat:tomcat-catalina. The target (Apache Tomcat 8.5.78) is not affected by CVE-2017-12617. The vulnerability allowed uploading JSP files via HTTP PUT with specially crafted paths ending in '/' to bypass security checks (the Java File API drops trailing slashes). The upstream Apache Tomcat project fixed this in commits 506d862e7e and 4cf7dab882 (authored by Mark Thomas, September 2017) by adding checks that reject file write operations when the path ends with '/'. These fixes were already present in Apache Tomcat release 8.5.78 before TuxCare onboarded it (first TuxCare commit: fb98844404 \"Onboard version 8.5.78\" by amoniatovskiy@cloudlinux.com). The defensive code is verified present at AbstractFileResourceSet.java:69 and DirResourceSet.java:252.", "justification": "code_not_present" } }, { "id": "CVE-2017-5648", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.78-tuxcare.4" } ], "bom-ref": "urn:uuid:d865713d-4d78-52a7-b5b1-c2482c0bb052", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-5648 does not affect version 8.5.78-tuxcare.4 of org.apache.tomcat:tomcat-catalina. Target Tomcat 8.5.78 is not affected by CVE-2017-5648. The vulnerability pattern (passing internal Request objects to application listeners without facade wrapping) is not present. All 7 call sites to fireRequestInitEvent() and fireRequestDestroyEvent() correctly use request.getRequest() to pass facade-wrapped objects. The fix was introduced by upstream commit 0f7b9465d5 (author: Mark Thomas, markt@apache.org) in March 2017 for Tomcat 8.5.12+, which was already present in the upstream 8.5.78 release when TuxCare onboarded it. CVE affects 8.5.0-8.5.11; target 8.5.78 is above this range.", "justification": "code_not_present" } }, { "id": "CVE-2019-0221", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.78-tuxcare.4" } ], "bom-ref": "urn:uuid:af5e5e6e-80b9-5295-84af-c24eb71041c6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-0221 does not affect version 8.5.78-tuxcare.4 of org.apache.tomcat:tomcat-catalina. not_affected \u2014 CVE-2019-0221 affects the SSI printenv command which echoed user-provided data without HTML entity encoding, enabling XSS attacks. The target Apache Tomcat 8.5.78 contains the upstream fix from commit 4fcdf706f3 (March 11, 2019) which adds HTML entity encoding via the ENCODING_ENTITY parameter to getVariableValue() calls. This fix applies Escape.htmlElementContent() to escape special characters...", "justification": "code_not_present" } }, { "id": "CVE-2020-9484", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.78-tuxcare.4" } ], "bom-ref": "urn:uuid:437375d6-71b1-57a0-a68e-0f34aafcc54b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-9484 does not affect version 8.5.78-tuxcare.4 of org.apache.tomcat:tomcat-catalina. CVE-2020-9484 deserialization vulnerability is NOT present in Apache Tomcat 8.5.78. The fix was authored by Mark Thomas (Apache upstream) on May 5, 2020, and shipped in Apache Tomcat 8.5.55. Version 8.5.78 inherits this fix from upstream. The FileStore.java file at lines 355-358 implements path traversal validation that rejects session IDs attempting to escape the storage directory, preventing deserialization of attacker-controlled files. CVE affected versions: 8.5.0 to 8.5.54; target version 8.5.78 is after the fixed version.", "justification": "code_not_present" } }, { "id": "CVE-2022-45143", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.78-tuxcare.4" } ], "bom-ref": "urn:uuid:d4ce745d-3fb9-5c9f-8a91-d520218c33e3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-45143 does not affect version 8.5.78-tuxcare.4 of org.apache.tomcat:tomcat-catalina. CVE-2022-45143 affects JsonErrorReportValve, which does not exist in Tomcat 8.5.78. The vulnerability involves missing JSON escaping in type/message/description fields. The target version only has ErrorReportValve, which generates HTML error reports with proper HTML escaping (Escape.htmlElementContent). JsonErrorReportValve was introduced upstream on 2020-10-14 in versions 8.5.83+, 9.0.40+, and 10.1.0+, never backported to 8.5.78. The attack chain (user-provided error data \u2192 manipulated JSON output) cannot complete because JSON error reporting does not exist in the target. Verdict: not_affected per Rule 5 Type A2 (input received but chain to Goal broken by missing JSON generation).", "justification": "code_not_reachable" } }, { "id": "CVE-2023-24998", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.78-tuxcare.4" } ], "bom-ref": "urn:uuid:64eec205-6ef0-55f3-88c8-38e12687a42f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-24998 affects version 8.5.78-tuxcare.4 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2023-28708", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.78-tuxcare.4" } ], "bom-ref": "urn:uuid:10cd07bf-0447-5ac6-a955-efb5eaa49043", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-28708 is fixed in version 8.5.78-tuxcare.4 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2023-41080", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.78-tuxcare.4" } ], "bom-ref": "urn:uuid:e8bae6c4-e2c2-5895-9cd7-7a4ae3f18b74", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-41080 is fixed in version 8.5.78-tuxcare.4 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2023-42795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.78-tuxcare.4" } ], "bom-ref": "urn:uuid:633cbcfa-04f3-53fd-afc4-c142031dd36a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-42795 affects version 8.5.78-tuxcare.4 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2023-46589", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.78-tuxcare.4" } ], "bom-ref": "urn:uuid:80fcc5b7-f1c0-5dca-8a75-62a3216638c3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-46589 affects version 8.5.78-tuxcare.4 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2024-50379", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.78-tuxcare.4" } ], "bom-ref": "urn:uuid:a286672a-78f8-5ad7-9439-3ebb1e014365", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-50379 affects version 8.5.78-tuxcare.4 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2024-52316", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.78-tuxcare.4" } ], "bom-ref": "urn:uuid:2e3652bc-c89d-5531-8e6c-8d45f6839df3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-52316 affects version 8.5.78-tuxcare.4 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2024-56337", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.78-tuxcare.4" } ], "bom-ref": "urn:uuid:a858a4b0-ae8f-5274-aecf-0ed384df8ad9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-56337 affects version 8.5.78-tuxcare.4 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-24813", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.78-tuxcare.4" } ], "bom-ref": "urn:uuid:0b6369e3-27fb-5115-8321-ba9e210a84e4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-24813 affects version 8.5.78-tuxcare.4 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-31651", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.78-tuxcare.4" } ], "bom-ref": "urn:uuid:7d6a1bac-e705-5039-b4e0-d91397c95712", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31651 affects version 8.5.78-tuxcare.4 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-46701", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.78-tuxcare.4" } ], "bom-ref": "urn:uuid:50981fc1-e630-58d8-800d-3fc884e42f21", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-46701 affects version 8.5.78-tuxcare.4 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-48988", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.78-tuxcare.4" } ], "bom-ref": "urn:uuid:79b79573-d80b-51ab-aa96-23ad6f1a307d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-48988 affects version 8.5.78-tuxcare.4 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-49124", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.78-tuxcare.4" } ], "bom-ref": "urn:uuid:540646c6-c862-5855-a383-778c71daaf1e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49124 affects version 8.5.78-tuxcare.4 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-49125", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.78-tuxcare.4" } ], "bom-ref": "urn:uuid:6363cbdb-b193-5a87-b385-f74d78c17672", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49125 affects version 8.5.78-tuxcare.4 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-52520", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.78-tuxcare.4" } ], "bom-ref": "urn:uuid:4f7e5180-6138-577b-ba19-b9894de30d2e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-52520 affects version 8.5.78-tuxcare.4 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-55668", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.78-tuxcare.4" } ], "bom-ref": "urn:uuid:292a6bd6-a628-53e4-b350-296d5b3094c7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55668 affects version 8.5.78-tuxcare.4 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-55752", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.78-tuxcare.4" } ], "bom-ref": "urn:uuid:8d3096a8-b9c8-5956-9714-c91e7027bfe6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-55752 is fixed in version 8.5.78-tuxcare.4 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-55754", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.78-tuxcare.4" } ], "bom-ref": "urn:uuid:bf1acf6f-36c0-5c49-bf2a-125a74196e98", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-55754 is fixed in version 8.5.78-tuxcare.4 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-61795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.78-tuxcare.4" } ], "bom-ref": "urn:uuid:54ca0bcf-87d7-5e81-ae19-263a206f6b2f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-61795 is fixed in version 8.5.78-tuxcare.4 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-25854", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.78-tuxcare.4" } ], "bom-ref": "urn:uuid:3ffe1289-f187-59c0-b6ce-773fdada9b21", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25854 is fixed in version 8.5.78-tuxcare.4 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-34483", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.78-tuxcare.4" } ], "bom-ref": "urn:uuid:b48a0a2d-64f9-5a12-b64d-a35aa4bcb86a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34483 affects version 8.5.78-tuxcare.4 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-41284", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.78-tuxcare.4" } ], "bom-ref": "urn:uuid:fb5fd783-8078-50a6-9861-46841a309dfc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41284 affects version 8.5.78-tuxcare.4 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-42498", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.78-tuxcare.4" } ], "bom-ref": "urn:uuid:2c22d14d-afce-5aa4-91c2-5be49fea5581", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42498 affects version 8.5.78-tuxcare.4 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-43512", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.78-tuxcare.4" } ], "bom-ref": "urn:uuid:515d508b-a229-5d2e-a116-a1710901a3dd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43512 affects version 8.5.78-tuxcare.4 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-43513", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.78-tuxcare.4" } ], "bom-ref": "urn:uuid:af0213e7-699d-5ee1-9369-9c9d87d1c4d9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43513 affects version 8.5.78-tuxcare.4 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-43514", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.78-tuxcare.4" } ], "bom-ref": "urn:uuid:be06581f-3c56-5104-a031-4b24eb157e8c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43514 affects version 8.5.78-tuxcare.4 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-43515", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.78-tuxcare.4" } ], "bom-ref": "urn:uuid:0d932839-6168-56b6-8736-477d554f0c38", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43515 affects version 8.5.78-tuxcare.4 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-53404", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.78-tuxcare.4" } ], "bom-ref": "urn:uuid:8e28ff5c-e78d-523f-a4ce-664a2147087e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53404 affects version 8.5.78-tuxcare.4 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-55956", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.78-tuxcare.4" } ], "bom-ref": "urn:uuid:7df9db7a-c8d3-5fdc-8510-180e7dd7fea4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-55956 affects version 8.5.78-tuxcare.4 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-55957", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.78-tuxcare.4" } ], "bom-ref": "urn:uuid:11155ebe-926e-59df-9bdf-923d018ca070", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-55957 affects version 8.5.78-tuxcare.4 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-65182", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.78-tuxcare.4" } ], "bom-ref": "urn:uuid:916996bd-0388-52d0-9259-988a8e37b9de", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65182 affects version 8.5.78-tuxcare.4 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-65905", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.78-tuxcare.4" } ], "bom-ref": "urn:uuid:37064b1a-e561-5043-b9bb-2f07d3059294", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65905 affects version 8.5.78-tuxcare.4 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-68525", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.78-tuxcare.4" } ], "bom-ref": "urn:uuid:51a9286e-be83-5aa4-ad2a-f450d3e2c834", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-68525 affects version 8.5.78-tuxcare.4 of org.apache.tomcat:tomcat-catalina." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@8.5.78-tuxcare.4" } ] }