{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:6fbc9bdd-50cd-5d2b-a9df-515f6c8fe28c", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat-catalina", "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.75-tuxcare.7", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.75-tuxcare.7", "version": "9.0.75-tuxcare.7", "pedigree": { "ancestors": [ { "name": "tomcat-catalina", "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.75", "type": "library", "group": "org.apache.tomcat", "version": "9.0.75" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-5388", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.75-tuxcare.7" } ], "bom-ref": "urn:uuid:9174ec36-0d55-58c5-9eb6-8ce0bac01ba0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-5388 does not affect version 9.0.75-tuxcare.7 of org.apache.tomcat:tomcat-catalina. CVE-2016-5388 (httpoxy) is NOT present in target Tomcat 9.0.75. The vulnerable code pattern (blacklist-based header filtering that allowed Proxy header to become HTTP_PROXY) was replaced by a whitelist approach in upstream commit fb3569fbb9 by Apache committer Mark Thomas. This fix shipped in the upstream release before TuxCare onboarding. The whitelist pattern (ACCEPT[-0-9A-Z]*|CACHE-CONTROL|COOKIE|HOST|IF-[-0-9A-Z]*|REFERER|USER-AGENT) explicitly excludes the Proxy header, preventing the httpoxy attack.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.0.0, < 7.0.72; >= 8.0.0, < 8.5.5), NVD (>= 6.0, <= 6.0.45; >= 7.0, <= 7.0.70; >= 8.0, <= 8.5.4), Snyk (>= 7.35, < 8.5.5; >= 7.35, < 8.5.5).", "justification": "code_not_present" } }, { "id": "CVE-2016-8735", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.75-tuxcare.7" } ], "bom-ref": "urn:uuid:d64fc1f2-fc64-5e76-bba9-8b0c72ecc978", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-8735 does not affect version 9.0.75-tuxcare.7 of org.apache.tomcat:tomcat-catalina. CVE-2016-8735 does not affect Apache Tomcat 9.0.75. The vulnerable component (JmxRemoteLifecycleListener) that handles JMX credentials was completely removed from Apache Tomcat 9.0.57 (January 2022, commit 510520cf49) by upstream developer Mark Thomas. Version 9.0.75, released after the component removal, does not contain any JMX remote listener code that could accept arbitrary credential types. The CVE affected versions before 9.0.0.M12 (November 2016), and while the fix was applied in 9.0.0.M12, the component was later deprecated and entirely removed from the 9.x branch. The target version has never contained this vulnerable component.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 6.0.48; >= 7.0.0, < 7.0.73; >= 8.0.0, < 8.0.39; >= 8.5.0, < 8.5.7; >= 9.0.0.M1, < 9.0.0.M12), NVD (< 6.0.48; >= 7.0.0, < 7.0.73; >= 8.0, < 8.0.39; >= 8.5.0, < 8.5.7; = 9.0.0; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (< 6.0.48; >= 7, < 7.0.73; >= 8, < 8.0.39; >= 8.5, < 8.5.7; >= 9, < 9.0.0.M12).", "justification": "code_not_present" } }, { "id": "CVE-2017-12616", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.75-tuxcare.7" } ], "bom-ref": "urn:uuid:974c7198-2fe1-5bc2-90bc-186881aed267", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-12616 does not affect version 9.0.75-tuxcare.7 of org.apache.tomcat:tomcat-catalina. CVE-2017-12616 affects VirtualDirContext and FileDirContext classes in Apache Tomcat 7.0.0-7.0.80. These classes allowed bypassing security constraints via specially crafted requests because certain methods (bind, rebind, rename, createSubcontext) bypassed centralized path validation. In Tomcat 9.0.75, these classes do not exist\u2014they were architecturally replaced with the WebResource system (WebResourceRoot, WebResourceSet) starting in Tomcat 8.0. The vulnerability pattern is not present because the vulnerable code was removed in an upstream architectural change.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.0.0, < 7.0.81), NVD (= 7.0.0; = 7.0.0-beta; = 7.0.1; = 7.0.2; = 7.0.2-beta; = 7.0.3; = 7.0.4; = 7.0.4-beta; = 7.0.5; = 7.0.5-beta; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 7.0.76; = 7.0.77; = 7.0.79; = 7.0.80), cve.org (>= 7.0.0, <= 7.0.80), Snyk (>= 7.0.0, < 7.0.81).", "justification": "code_not_present" } }, { "id": "CVE-2017-12617", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.75-tuxcare.7" } ], "bom-ref": "urn:uuid:65b7f1bb-fb5d-598e-b2e9-afbe967450bb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-12617 does not affect version 9.0.75-tuxcare.7 of org.apache.tomcat:tomcat-catalina. CVE-2017-12617 is not present in Apache Tomcat 9.0.75-tuxcare.7. The vulnerability allowed uploading JSP files via HTTP PUT when readonly=false by exploiting Java's File API normalization of trailing slashes (e.g., \"shell.jsp/\" \u2192 \"shell.jsp\"). The upstream vendor (Apache) fixed this in commit b7e0435d17 by adding validation to reject paths ending in '/' during file creation and lookup operations. This fix was already included in the upstream Apache Tomcat 9.0.75 release that TuxCare onboarded, as confirmed by the fix commit being an ancestor of both the upstream 9.0.75 tag and predating the first TuxCare commit in HEAD's history. The target contains both required defenses: DirResourceSet.write() rejects creation paths ending in '/', and AbstractFileResourceSet.file() returns null for such paths during lookups.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82; >= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82), NVD (>= 7.0.0, < 7.0.82; >= 8.0, < 8.0.47; >= 8.5.0, < 8.5.23; >= 9.0.0, < 9.0.1), cve.org (>= 9.0.0.M1, <= 9.0.0; >= 8.5.0, <= 8.5.22; >= 8.0.0.RC1, <= 8.0.46; >= 7.0.0, <= 7.0.81), Snyk (< 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1).", "justification": "code_not_present" } }, { "id": "CVE-2017-5648", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.75-tuxcare.7" } ], "bom-ref": "urn:uuid:da9ec262-6ddc-5323-af24-69dd4670b277", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-5648 does not affect version 9.0.75-tuxcare.7 of org.apache.tomcat:tomcat-catalina. CVE-2017-5648 is NOT present in Apache Tomcat 9.0.75. The vulnerability affected versions up to 9.0.0.M17, requiring facade objects when firing application listeners to prevent untrusted code from retaining references to internal request/response objects under SecurityManager. The fix was committed to upstream Apache Tomcat by Mark Thomas (markt@apache.org) on March 6, 2017, approximately 6 years before the 9.0.75 release. All three affected files (FormAuthenticator.java, AsyncContextImpl.java, StandardHostValve.java) correctly use request.getRequest() to pass facade objects when firing listener events. The fix commit dfa40863421d7681fed893b4256666491887e38c is an ancestor of both the upstream 9.0.75 tag and the first TuxCare commit on this branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76; >= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76), NVD (= 7.0.0; = 7.0.1; = 7.0.2; = 7.0.3; = 7.0.4; = 7.0.5; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.52; = 7.0.53; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 8.0.0; = 8.0.0-rc1; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.8; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M17; >= 8.5.0, <= 8.5.11; >= 8.0.0.RC1, <= 8.0.41; >= 7.0.0, <= 7.0.75), Snyk (>= 7.0.0, < 7.0.76; >= 8, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9-alpha, < 9.0.0.M17; >= 7.0.0, < 7.0.76; >= 8.0.0-RC1, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9.0.0.M1, < 9.0.0.M17).", "justification": "code_not_present" } }, { "id": "CVE-2019-0221", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.75-tuxcare.7" } ], "bom-ref": "urn:uuid:e4d84576-2526-5761-9064-3306282bb4f1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-0221 does not affect version 9.0.75-tuxcare.7 of org.apache.tomcat:tomcat-catalina. not_affected \u2014 CVE-2019-0221 affects the SSI printenv command which outputs environment variables without HTML encoding, enabling XSS attacks. The target Apache Tomcat 9.0.75 repository is NOT AFFECTED because the upstream fix (commit 15fcd166ea by markt@apache.org from March 2019) was already present in the Apache Tomcat 9.0.75 release that TuxCare onboarded. The code at HEAD correctly uses getVariableValue(...", "justification": "code_not_present" } }, { "id": "CVE-2020-9484", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.75-tuxcare.7" } ], "bom-ref": "urn:uuid:b1eb8ee3-0356-586e-a32d-f081e5e58307", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-9484 does not affect version 9.0.75-tuxcare.7 of org.apache.tomcat:tomcat-catalina. Fix already present in baseline since 9.0.35. Verified in java/org/apache/catalina/session/FileStore.java:303 \u2014 canonicalFile.toPath().startsWith(storageDir.getCanonicalFile().toPath()) containment check is in place. Advisory range 9.0.0.M1-9.0.34; 9.0.90 is well past the fix.", "justification": "code_not_present" } }, { "id": "CVE-2022-45143", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.75-tuxcare.7" } ], "bom-ref": "urn:uuid:9c609aec-7389-5fee-a838-9926748bd96c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-45143 affects version 9.0.75-tuxcare.7 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2023-24998", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.75-tuxcare.7" } ], "bom-ref": "urn:uuid:75bb4797-5fd8-5af3-9dad-c33b5e578549", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-24998 does not affect version 9.0.75-tuxcare.7 of org.apache.tomcat:tomcat-catalina. Apache Tomcat 9.0.75 is not affected by CVE-2023-24998. The vulnerability concerns unlimited file upload parts causing DoS, fixed by adding fileCountMax validation. The fix was implemented by upstream Apache (Mark Thomas, commit cf77cc545de, 2022-12-13) and shipped in Apache Tomcat 9.0.75's upstream release. TuxCare onboarded version 9.0.75 with the fix already present. All fix components exist in the target: FileUploadBase has fileCountMax field/getters/setters and validation check (lines 318-321), Request.java has setFileCountMax integration (line 2862), and FileCountLimitExceededException class exists.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71), cve.org (= 11.0.0-M1; >= 10.0.0-M1, <= 10.1.4; >= 9.0.0-M1, <= 9.0.70; >= 8.5.0, <= 8.5.84), Snyk (>= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3; >= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3; >= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3).", "justification": "code_not_present" } }, { "id": "CVE-2023-28708", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.75-tuxcare.7" } ], "bom-ref": "urn:uuid:40c27990-6751-509b-bca3-6b8250a1fc26", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-28708 does not affect version 9.0.75-tuxcare.7 of org.apache.tomcat:tomcat-catalina. not_affected \u2014 Apache Tomcat 9.0.75 is NOT AFFECTED by CVE-2023-28708. The vulnerability (missing Secure attribute on session cookies when RemoteIpFilter processes X-Forwarded-Proto: https) was fixed in upstream Apache Tomcat release 9.0.72 (February 2023) via commit 3b51230764 by lihan@apache.org. This fix was already present when TuxCare onboarded version 9.0.75. All three components of the fix are present:...", "justification": "code_not_present" } }, { "id": "CVE-2023-41080", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.75-tuxcare.7" } ], "bom-ref": "urn:uuid:adf33851-365f-514f-a936-6ff3e3909cef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-41080 is fixed in version 9.0.75-tuxcare.7 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2023-42795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.75-tuxcare.7" } ], "bom-ref": "urn:uuid:5f7eb36a-4262-58d9-a8aa-0eec681e43bb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-42795 is fixed in version 9.0.75-tuxcare.7 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2023-46589", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.75-tuxcare.7" } ], "bom-ref": "urn:uuid:f4117044-d106-5116-8f12-a908525781c0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-46589 is fixed in version 9.0.75-tuxcare.7 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2024-50379", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.75-tuxcare.7" } ], "bom-ref": "urn:uuid:024871a6-70f4-58e1-8f1e-e468544752f6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-50379 is fixed in version 9.0.75-tuxcare.7 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2024-52316", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.75-tuxcare.7" } ], "bom-ref": "urn:uuid:d46d0b2b-6bf3-52dd-a092-a20d2cd4e7e8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-52316 is fixed in version 9.0.75-tuxcare.7 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2024-56337", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.75-tuxcare.7" } ], "bom-ref": "urn:uuid:d56681f0-fbd6-5d1b-b698-5add3871874e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-56337 is fixed in version 9.0.75-tuxcare.7 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-24813", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.75-tuxcare.7" } ], "bom-ref": "urn:uuid:b57fbfd3-f643-5ef5-9108-7a2881ef961d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-24813 is fixed in version 9.0.75-tuxcare.7 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-31651", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.75-tuxcare.7" } ], "bom-ref": "urn:uuid:96316b14-e180-5ccb-9620-811491f341aa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-31651 is fixed in version 9.0.75-tuxcare.7 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-46701", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.75-tuxcare.7" } ], "bom-ref": "urn:uuid:ccba5c54-6b00-5861-9c94-7c0fef8995b3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-46701 is fixed in version 9.0.75-tuxcare.7 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-48988", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.75-tuxcare.7" } ], "bom-ref": "urn:uuid:67d358d9-b03d-5654-9bc9-f048c9ca6506", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48988 is fixed in version 9.0.75-tuxcare.7 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-49124", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.75-tuxcare.7" } ], "bom-ref": "urn:uuid:898db8ce-2ae4-52b1-bd02-8d946a1a76ea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-49124 is fixed in version 9.0.75-tuxcare.7 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-49125", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.75-tuxcare.7" } ], "bom-ref": "urn:uuid:666e13c4-15de-55c5-a2f8-3743154b9f79", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-49125 is fixed in version 9.0.75-tuxcare.7 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-52520", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.75-tuxcare.7" } ], "bom-ref": "urn:uuid:910522d1-6f4d-554e-9a59-83b4f43031cf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-52520 is fixed in version 9.0.75-tuxcare.7 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-55668", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.75-tuxcare.7" } ], "bom-ref": "urn:uuid:6106f8c5-4e86-559a-b827-bd7a59de9d6f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-55668 is fixed in version 9.0.75-tuxcare.7 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-55752", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.75-tuxcare.7" } ], "bom-ref": "urn:uuid:a47a15af-deda-573d-a589-91406e6ac876", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-55752 is fixed in version 9.0.75-tuxcare.7 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-55754", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.75-tuxcare.7" } ], "bom-ref": "urn:uuid:cb853b0c-0fd7-5b12-868a-8528b872f59a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-55754 is fixed in version 9.0.75-tuxcare.7 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-61795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.75-tuxcare.7" } ], "bom-ref": "urn:uuid:957582cf-92cf-56fc-8548-f3a01b712ce1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-61795 is fixed in version 9.0.75-tuxcare.7 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-25854", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.75-tuxcare.7" } ], "bom-ref": "urn:uuid:c47a18a1-f3d0-5f95-a0ed-8672d2eba25c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25854 is fixed in version 9.0.75-tuxcare.7 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-34483", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.75-tuxcare.7" } ], "bom-ref": "urn:uuid:944a4a7b-347a-591d-ae91-6bb72d67c19a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34483 is fixed in version 9.0.75-tuxcare.7 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-41284", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.75-tuxcare.7" } ], "bom-ref": "urn:uuid:378ca625-bb94-5cbf-abf6-3d1fccb0d206", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41284 affects version 9.0.75-tuxcare.7 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-42498", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.75-tuxcare.7" } ], "bom-ref": "urn:uuid:62a15e06-9a53-578e-965b-051cf416f92f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42498 affects version 9.0.75-tuxcare.7 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-43512", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.75-tuxcare.7" } ], "bom-ref": "urn:uuid:852ec625-1a69-564b-9ac0-1ebcbbc6339a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-43512 is fixed in version 9.0.75-tuxcare.7 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-43513", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.75-tuxcare.7" } ], "bom-ref": "urn:uuid:b33da4f1-9897-574f-b79a-0bd3de1e8b71", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43513 affects version 9.0.75-tuxcare.7 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-43514", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.75-tuxcare.7" } ], "bom-ref": "urn:uuid:4d000082-c6d8-577e-80ff-7d213b85cbf7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43514 affects version 9.0.75-tuxcare.7 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-43515", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.75-tuxcare.7" } ], "bom-ref": "urn:uuid:78e2037d-c7ed-50df-bd47-d5cb3a249df8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43515 affects version 9.0.75-tuxcare.7 of org.apache.tomcat:tomcat-catalina, and is fixed in 9.0.75-tuxcare.8." } }, { "id": "CVE-2026-53404", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.75-tuxcare.7" } ], "bom-ref": "urn:uuid:0eace24b-070f-5229-9f90-372216711691", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53404 affects version 9.0.75-tuxcare.7 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-55956", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.75-tuxcare.7" } ], "bom-ref": "urn:uuid:766db1ff-90c8-5891-9663-cd7f47b38ed4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-55956 affects version 9.0.75-tuxcare.7 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-55957", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.75-tuxcare.7" } ], "bom-ref": "urn:uuid:49118389-792b-5eab-a89b-a31459d3533e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-55957 affects version 9.0.75-tuxcare.7 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-65182", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.75-tuxcare.7" } ], "bom-ref": "urn:uuid:1a5af48f-b79d-5dc1-87c7-bb7b9e439370", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65182 affects version 9.0.75-tuxcare.7 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-65905", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.75-tuxcare.7" } ], "bom-ref": "urn:uuid:5d171420-5feb-5941-ab0f-7af8db2b63e7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65905 is fixed in version 9.0.75-tuxcare.7 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-68525", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.75-tuxcare.7" } ], "bom-ref": "urn:uuid:3acb7b9e-0ae3-57f8-b457-1ea7529110ec", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-68525 affects version 9.0.75-tuxcare.7 of org.apache.tomcat:tomcat-catalina." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.75-tuxcare.7" } ] }