{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:c37e0253-0efa-50e0-a5f7-73510f088c5d", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat-catalina", "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.18", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.18", "version": "9.0.50-tuxcare.18", "pedigree": { "ancestors": [ { "name": "tomcat-catalina", "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50", "type": "library", "group": "org.apache.tomcat", "version": "9.0.50" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-5388", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.18" } ], "bom-ref": "urn:uuid:5f97be6e-5816-56c3-a078-7b8bdfea275f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-5388 does not affect version 9.0.50-tuxcare.18 of org.apache.tomcat:tomcat-catalina. CVE-2016-5388 (httpoxy) is NOT present in Apache Tomcat 9.0.50. The vulnerability was fixed by upstream Apache in August 2016 (commit fb3569fbb9), well before the 9.0.50 release in 2021. The fix replaces the vulnerable blacklist approach (blocking only AUTHORIZATION and PROXY_AUTHORIZATION headers) with a secure whitelist pattern that only allows specific safe headers to become CGI environment variables, preventing attackers from setting HTTP_PROXY or other dangerous environment variables via crafted HTTP headers.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.0.0, < 7.0.72; >= 8.0.0, < 8.5.5), NVD (>= 6.0, <= 6.0.45; >= 7.0, <= 7.0.70; >= 8.0, <= 8.5.4), Snyk (>= 7.35, < 8.5.5; >= 7.35, < 8.5.5).", "justification": "code_not_present" } }, { "id": "CVE-2016-8735", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.18" } ], "bom-ref": "urn:uuid:5b11eb12-7980-54e3-802f-156fb13f46b2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-8735 does not affect version 9.0.50-tuxcare.18 of org.apache.tomcat:tomcat-catalina. The target Apache Tomcat 9.0.50 is NOT AFFECTED by CVE-2016-8735. The vulnerability fix (restricting JMX RMI credential types to prevent arbitrary object deserialization) was already present in the upstream Tomcat 9.0.50 release. The fix commit 0e83ad3e547fc9a75a258799ef581249b40a82a6 by Apache committer Mark Thomas predates TuxCare's onboarding and is an ancestor of the first TuxCare commit in this branch's history. The vulnerable code pattern (unrestricted credential types allowing arbitrary deserialization) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 6.0.48; >= 7.0.0, < 7.0.73; >= 8.0.0, < 8.0.39; >= 8.5.0, < 8.5.7; >= 9.0.0.M1, < 9.0.0.M12), NVD (< 6.0.48; >= 7.0.0, < 7.0.73; >= 8.0, < 8.0.39; >= 8.5.0, < 8.5.7; = 9.0.0; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (< 6.0.48; >= 7, < 7.0.73; >= 8, < 8.0.39; >= 8.5, < 8.5.7; >= 9, < 9.0.0.M12).", "justification": "code_not_present" } }, { "id": "CVE-2017-12616", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.18" } ], "bom-ref": "urn:uuid:5379f089-6ce0-530e-a118-3f4f79092264", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-12616 does not affect version 9.0.50-tuxcare.18 of org.apache.tomcat:tomcat-catalina. CVE-2017-12616 specifically affects Apache Tomcat 7.0.0 to 7.0.80 using VirtualDirContext. The target (Tomcat 9.0.50) uses a completely different architecture (WebResourceRoot/ResourceSets) introduced in 2012 that has canonical path validation built-in from inception. The vulnerable code pattern (direct File object creation without validation) does not exist in Tomcat 9.x - all file operations route through AbstractFileResourceSet.file() which validates paths against the canonical base, preventing directory traversal and unauthorized access. This architectural defense predates the CVE by 5 years.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.0.0, < 7.0.81), NVD (= 7.0.0; = 7.0.0-beta; = 7.0.1; = 7.0.2; = 7.0.2-beta; = 7.0.3; = 7.0.4; = 7.0.4-beta; = 7.0.5; = 7.0.5-beta; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 7.0.76; = 7.0.77; = 7.0.79; = 7.0.80), cve.org (>= 7.0.0, <= 7.0.80), Snyk (>= 7.0.0, < 7.0.81).", "justification": "code_not_reachable" } }, { "id": "CVE-2017-12617", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.18" } ], "bom-ref": "urn:uuid:99c48e72-40f2-5eba-81cf-99cb3e0ad266", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-12617 does not affect version 9.0.50-tuxcare.18 of org.apache.tomcat:tomcat-catalina. CVE-2017-12617 is NOT present in Tomcat 9.0.50. The vulnerability allowed uploading JSP files via HTTP PUT with trailing-slash manipulation (e.g., \"file.jsp/\" creates \"file.jsp\" due to Java File API behavior). Apache fixed this in September 2017 via commits b7e0435d17 (blocks write operations with trailing slash) and b577f9a799 (blocks file lookups with trailing slash). Both fixes are present in HEAD and shipped in the upstream 9.0.1+ releases, well before 9.0.50. The vulnerable code pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82; >= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82), NVD (>= 7.0.0, < 7.0.82; >= 8.0, < 8.0.47; >= 8.5.0, < 8.5.23; >= 9.0.0, < 9.0.1), cve.org (>= 9.0.0.M1, <= 9.0.0; >= 8.5.0, <= 8.5.22; >= 8.0.0.RC1, <= 8.0.46; >= 7.0.0, <= 7.0.81), Snyk (< 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1).", "justification": "code_not_present" } }, { "id": "CVE-2017-5648", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.18" } ], "bom-ref": "urn:uuid:2beaafdc-c4b0-5e23-a22f-a29c9a5bba41", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-5648 does not affect version 9.0.50-tuxcare.18 of org.apache.tomcat:tomcat-catalina. CVE-2017-5648 is NOT present in Tomcat 9.0.50. The vulnerability involved application listeners receiving unfacaded internal Request/Response objects under SecurityManager, allowing cross-application data access. The upstream Apache fix (commit dfa4086342, March 2017) wrapped all listener invocations with facades via request.getRequest(). This fix was already present in the upstream 9.0.50 release (July 2021) that TuxCare onboarded. All three affected files (FormAuthenticator.java, AsyncContextImpl.java, StandardHostValve.java) use facades in the target. No vulnerable code paths exist.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76; >= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76), NVD (= 7.0.0; = 7.0.1; = 7.0.2; = 7.0.3; = 7.0.4; = 7.0.5; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.52; = 7.0.53; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 8.0.0; = 8.0.0-rc1; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.8; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M17; >= 8.5.0, <= 8.5.11; >= 8.0.0.RC1, <= 8.0.41; >= 7.0.0, <= 7.0.75), Snyk (>= 7.0.0, < 7.0.76; >= 8, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9-alpha, < 9.0.0.M17; >= 7.0.0, < 7.0.76; >= 8.0.0-RC1, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9.0.0.M1, < 9.0.0.M17).", "justification": "code_not_present" } }, { "id": "CVE-2019-0221", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.18" } ], "bom-ref": "urn:uuid:f8ccbd8d-e55e-52d4-b65f-a83c9a68a582", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-0221 does not affect version 9.0.50-tuxcare.18 of org.apache.tomcat:tomcat-catalina. not_affected \u2014 CVE-2019-0221 affects Apache Tomcat versions 9.0.0.M1 to 9.0.17. The target is version 9.0.50, which already contains the fix in the upstream release. The SSIPrintenv command uses entity encoding (SSIMediator.ENCODING_ENTITY) to escape user-provided data before output, preventing XSS. The fix was introduced by upstream commit 15fcd166ea by Mark Thomas (markt@apache.org) on March 11, 2019, well ...", "justification": "code_not_present" } }, { "id": "CVE-2020-9484", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.18" } ], "bom-ref": "urn:uuid:57f50bb6-23e8-5c81-8c40-cb1ca95ca053", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-9484 does not affect version 9.0.50-tuxcare.18 of org.apache.tomcat:tomcat-catalina. Fix already present in baseline since 9.0.35. Verified in java/org/apache/catalina/session/FileStore.java:303 \u2014 canonicalFile.toPath().startsWith(storageDir.getCanonicalFile().toPath()) containment check is in place. Advisory range 9.0.0.M1-9.0.34; 9.0.90 is well past the fix.", "justification": "code_not_present" } }, { "id": "CVE-2022-45143", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.18" } ], "bom-ref": "urn:uuid:48888f6b-76be-58fa-a402-b4a043c9b150", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-45143 is fixed in version 9.0.50-tuxcare.18 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2023-24998", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.18" } ], "bom-ref": "urn:uuid:c6927a19-7b37-5015-ae72-ac90a04e1ba4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-24998 is fixed in version 9.0.50-tuxcare.18 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2023-28708", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.18" } ], "bom-ref": "urn:uuid:88747297-1ec9-5b2d-84da-fe8e343c4dd3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-28708 is fixed in version 9.0.50-tuxcare.18 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2023-41080", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.18" } ], "bom-ref": "urn:uuid:1ed72388-7073-5ca3-85b1-550587736ffa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-41080 is fixed in version 9.0.50-tuxcare.18 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2023-42795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.18" } ], "bom-ref": "urn:uuid:6fb18aef-cb10-553c-8f82-f4696f2269cf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-42795 is fixed in version 9.0.50-tuxcare.18 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2023-46589", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.18" } ], "bom-ref": "urn:uuid:19c899b7-e5f2-5a84-8254-6b64427c9aca", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-46589 is fixed in version 9.0.50-tuxcare.18 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2024-50379", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.18" } ], "bom-ref": "urn:uuid:84bde0ed-1128-5312-a338-a4c418f91514", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-50379 is fixed in version 9.0.50-tuxcare.18 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2024-52316", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.18" } ], "bom-ref": "urn:uuid:fba38f3a-bfcd-58c0-a1a9-09b8eb304fce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-52316 is fixed in version 9.0.50-tuxcare.18 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2024-56337", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.18" } ], "bom-ref": "urn:uuid:fdbc5a51-8e89-525f-aaa0-a813f246ccf8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-56337 is fixed in version 9.0.50-tuxcare.18 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-24813", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.18" } ], "bom-ref": "urn:uuid:2ef22004-7ad1-5cd0-a975-5d5903ebb27b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-24813 is fixed in version 9.0.50-tuxcare.18 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-31651", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.18" } ], "bom-ref": "urn:uuid:07047a54-92d7-5560-9c64-b2cf55d1edfb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-31651 is fixed in version 9.0.50-tuxcare.18 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-46701", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.18" } ], "bom-ref": "urn:uuid:2bb7e78d-d592-56f8-a6be-63fefa9a899e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-46701 is fixed in version 9.0.50-tuxcare.18 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-48988", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.18" } ], "bom-ref": "urn:uuid:f8787d03-01eb-51e6-bafe-c566d9c25f77", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48988 is fixed in version 9.0.50-tuxcare.18 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-49124", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.18" } ], "bom-ref": "urn:uuid:ec48291a-36df-518b-9480-f39c983c2690", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-49124 is fixed in version 9.0.50-tuxcare.18 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-49125", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.18" } ], "bom-ref": "urn:uuid:db401a68-9326-5d80-8c8b-93a950a4debc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-49125 is fixed in version 9.0.50-tuxcare.18 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-52520", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.18" } ], "bom-ref": "urn:uuid:c417d25c-0c01-5cb8-8075-898572d17b49", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-52520 is fixed in version 9.0.50-tuxcare.18 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-55668", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.18" } ], "bom-ref": "urn:uuid:70c1ec6b-e793-589f-9a40-744351751e3a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-55668 is fixed in version 9.0.50-tuxcare.18 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-55752", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.18" } ], "bom-ref": "urn:uuid:9481c8b2-d85e-5334-854f-6097836314a3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55752 affects version 9.0.50-tuxcare.18 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-55754", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.18" } ], "bom-ref": "urn:uuid:9b6d4a41-9063-5bc4-96fa-df914c38bdc7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-55754 is fixed in version 9.0.50-tuxcare.18 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-61795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.18" } ], "bom-ref": "urn:uuid:85491790-2eef-5f5a-ac81-4caa6f92744f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-61795 is fixed in version 9.0.50-tuxcare.18 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-25854", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.18" } ], "bom-ref": "urn:uuid:b9e2f477-6d1e-5618-9af1-ec5e397b73f3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25854 is fixed in version 9.0.50-tuxcare.18 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-34483", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.18" } ], "bom-ref": "urn:uuid:fcdba944-ee58-578a-bbbc-6ee5f7a2ea5b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34483 is fixed in version 9.0.50-tuxcare.18 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-41284", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.18" } ], "bom-ref": "urn:uuid:41a83569-4275-5696-a133-9532b6e8faef", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41284 affects version 9.0.50-tuxcare.18 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-42498", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.18" } ], "bom-ref": "urn:uuid:18676f67-391e-5570-aafb-0c598c3c571f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42498 affects version 9.0.50-tuxcare.18 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-43512", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.18" } ], "bom-ref": "urn:uuid:bac1978c-d48f-53b8-b2df-3802b488912a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-43512 is fixed in version 9.0.50-tuxcare.18 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-43513", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.18" } ], "bom-ref": "urn:uuid:a553da84-256a-599a-8c3f-02fdb3129264", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43513 affects version 9.0.50-tuxcare.18 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-43514", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.18" } ], "bom-ref": "urn:uuid:b346d4a8-882b-585c-bab4-5df4517e2d19", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43514 affects version 9.0.50-tuxcare.18 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-43515", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.18" } ], "bom-ref": "urn:uuid:4374f709-e18c-5b0d-a562-b5c4309d43e7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-43515 is fixed in version 9.0.50-tuxcare.18 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-53404", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.18" } ], "bom-ref": "urn:uuid:7590c1fe-e334-5394-8f87-e5f30c6975ce", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53404 affects version 9.0.50-tuxcare.18 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-55956", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.18" } ], "bom-ref": "urn:uuid:dc15ffb5-ca55-522a-a3de-f6dfdb65f071", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-55956 affects version 9.0.50-tuxcare.18 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-55957", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.18" } ], "bom-ref": "urn:uuid:582c74f0-e222-515c-8de4-a57edca769e2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-55957 affects version 9.0.50-tuxcare.18 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-65182", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.18" } ], "bom-ref": "urn:uuid:e3720737-ddd7-5439-8d2a-2e6cc12e496a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65182 affects version 9.0.50-tuxcare.18 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-65905", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.18" } ], "bom-ref": "urn:uuid:9505fb0a-faca-5a0a-afa7-6844ff603277", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65905 is fixed in version 9.0.50-tuxcare.18 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-68525", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.18" } ], "bom-ref": "urn:uuid:f8ba9048-dd4a-5782-9df8-1a771d23de6a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-68525 affects version 9.0.50-tuxcare.18 of org.apache.tomcat:tomcat-catalina." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.50-tuxcare.18" } ] }