{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:792de573-5f06-5ab5-9437-6288a712da73",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "tomcat-catalina",
      "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.83-tuxcare.6",
      "type": "library",
      "group": "org.apache.tomcat",
      "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.83-tuxcare.6",
      "version": "9.0.83-tuxcare.6",
      "pedigree": {
        "ancestors": [
          {
            "name": "tomcat-catalina",
            "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.83",
            "type": "library",
            "group": "org.apache.tomcat",
            "version": "9.0.83"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2016-5388",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.83-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:2e9ba22e-c6b8-5506-ab6b-27ebcabc4b31",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-5388 does not affect version 9.0.83-tuxcare.6 of org.apache.tomcat:tomcat-catalina. CVE-2016-5388 (httpoxy) is NOT present in Tomcat 9.0.83. The vulnerable blocklist-based HTTP header filtering in CGIServlet has been replaced with a secure allowlist pattern that excludes the \"Proxy\" header. This fix was included in upstream Apache Tomcat 9.0.83 (commit fb3569fbb9 by Mark Thomas, August 2016) before TuxCare onboarded this version. The first TuxCare commit (a4eaee5ab1) came after the fix was already in place.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.0.0, < 7.0.72; >= 8.0.0, < 8.5.5), NVD (>= 6.0, <= 6.0.45; >= 7.0, <= 7.0.70; >= 8.0, <= 8.5.4), Snyk (>= 7.35, < 8.5.5; >= 7.35, < 8.5.5).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-8735",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.83-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:0e45fc04-1e5d-5f05-8aa3-7ec673fa8a53",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-8735 does not affect version 9.0.83-tuxcare.6 of org.apache.tomcat:tomcat-catalina. CVE-2016-8735 affects JmxRemoteLifecycleListener, which allowed remote code execution via unsafe deserialization of credential objects. Apache Tomcat 9.0.83 is not affected because the vulnerable component (JmxRemoteLifecycleListener.java) was completely removed by Apache upstream in January 2020, over 3 years before version 9.0.83 was released (November 2023). The vendor's chosen fix strategy was to deprecate and remove the listener entirely, as its functionality was superseded by the JRE's built-in remote JMX capabilities.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 6.0.48; >= 7.0.0, < 7.0.73; >= 8.0.0, < 8.0.39; >= 8.5.0, < 8.5.7; >= 9.0.0.M1, < 9.0.0.M12), NVD (< 6.0.48; >= 7.0.0, < 7.0.73; >= 8.0, < 8.0.39; >= 8.5.0, < 8.5.7; = 9.0.0; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (< 6.0.48; >= 7, < 7.0.73; >= 8, < 8.0.39; >= 8.5, < 8.5.7; >= 9, < 9.0.0.M12).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-12616",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.83-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:424d278a-3cc5-5473-b10f-3a0dd9eebfd2",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-12616 does not affect version 9.0.83-tuxcare.6 of org.apache.tomcat:tomcat-catalina. Tomcat 9.0.83 is NOT affected by CVE-2017-12616. The vulnerable components (VirtualDirContext and FileDirContext from org.apache.naming.resources) do not exist in this version. They were replaced by a new architecture (WebResourceRoot/AbstractFileResourceSet) in October 2012, before Tomcat 9.0.0 was released. The replacement architecture includes comprehensive canonical path validation that prevents the path traversal vulnerability described in CVE-2017-12616. This CVE specifically affects Tomcat 7.0.0-7.0.80 which used the old VirtualDirContext implementation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.0.0, < 7.0.81), NVD (= 7.0.0; = 7.0.0-beta; = 7.0.1; = 7.0.2; = 7.0.2-beta; = 7.0.3; = 7.0.4; = 7.0.4-beta; = 7.0.5; = 7.0.5-beta; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 7.0.76; = 7.0.77; = 7.0.79; = 7.0.80), cve.org (>= 7.0.0, <= 7.0.80), Snyk (>= 7.0.0, < 7.0.81).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-12617",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.83-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:9f09674e-1872-52db-a1bc-44503f8650e4",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-12617 does not affect version 9.0.83-tuxcare.6 of org.apache.tomcat:tomcat-catalina. CVE-2017-12617 is NOT present in Tomcat 9.0.83. The vulnerability allowed uploading JSP files via specially crafted PUT requests with trailing slashes (e.g., \"evil.jsp/\"). The Java File API silently drops trailing slashes, causing path confusion that bypassed security checks. The upstream fix (commit b7e0435d17 by markt@apache.org) was already included in version 9.0.83 before TuxCare onboarding. The fix adds two defenses: (1) file lookup rejects paths ending in '/' when they resolve to files (AbstractFileResourceSet.file() lines 66-71), and (2) file creation rejects paths ending in '/' (DirResourceSet.write() lines 264-268). Both defenses are present and active in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82; >= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82), NVD (>= 7.0.0, < 7.0.82; >= 8.0, < 8.0.47; >= 8.5.0, < 8.5.23; >= 9.0.0, < 9.0.1), cve.org (>= 9.0.0.M1, <= 9.0.0; >= 8.5.0, <= 8.5.22; >= 8.0.0.RC1, <= 8.0.46; >= 7.0.0, <= 7.0.81), Snyk (< 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-5648",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.83-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:41e6b555-35ca-5267-84d5-e247108d0b91",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-5648 does not affect version 9.0.83-tuxcare.6 of org.apache.tomcat:tomcat-catalina. CVE-2017-5648 is not present in Tomcat 9.0.83. The vulnerability concerned improper use of internal request/response objects (instead of facades) when firing application listeners, allowing untrusted applications to retain references and access data from other web applications. The upstream fix (commit dfa4086342 by markt@apache.org) was applied in Tomcat 9.0.0-M18 (March 2017) and shipped in the upstream release that TuxCare onboarded. All affected code locations now correctly use request.getRequest() to pass facade objects to listener methods (fireRequestInitEvent/fireRequestDestroyEvent), preventing cross-application data access.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76; >= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76), NVD (= 7.0.0; = 7.0.1; = 7.0.2; = 7.0.3; = 7.0.4; = 7.0.5; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.52; = 7.0.53; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 8.0.0; = 8.0.0-rc1; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.8; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M17; >= 8.5.0, <= 8.5.11; >= 8.0.0.RC1, <= 8.0.41; >= 7.0.0, <= 7.0.75), Snyk (>= 7.0.0, < 7.0.76; >= 8, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9-alpha, < 9.0.0.M17; >= 7.0.0, < 7.0.76; >= 8.0.0-RC1, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9.0.0.M1, < 9.0.0.M17).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2019-0221",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.83-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:9f1cffcb-af55-51bb-8152-0c72b17d09f7",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-0221 does not affect version 9.0.83-tuxcare.6 of org.apache.tomcat:tomcat-catalina. not_affected \u2014 CVE-2019-0221 is NOT present in Tomcat 9.0.83. The vulnerability (SSI printenv command echoing user data without escaping, leading to XSS) was fixed by upstream commit 15fcd166ea on 2019-03-11 by Mark Thomas (markt@apache.org). This fix was already present in the Apache Tomcat 9.0.83 release before TuxCare onboarded it. The current code applies HTML entity encoding via SSIMediator.ENCODING_ENTI...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-9484",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.83-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:ae8955a3-51cc-5cf9-9f99-6bd9e3ba7005",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-9484 does not affect version 9.0.83-tuxcare.6 of org.apache.tomcat:tomcat-catalina. Apache Tomcat 9.0.83 is not affected by CVE-2020-9484. The vulnerability (path traversal in session ID allowing arbitrary file deserialization) was fixed by upstream Apache in commit 3aa8f28db7e (Mark Thomas, May 2020) before version 9.0.83 was released. The fix validates that session file paths remain within the storage directory using canonical path comparison. CVE-2020-9484 affected versions 9.0.0.M1 to 9.0.34; version 9.0.83 was released later with the fix already present in the upstream codebase.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-45143",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.83-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:0f772537-9459-5877-bcdb-970a29c22ddc",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-45143 does not affect version 9.0.83-tuxcare.6 of org.apache.tomcat:tomcat-catalina. Apache Tomcat 9.0.83 is not affected by CVE-2022-45143. The upstream Apache fix (commit b336f4e58893ea35114f1e4a415657f723b1298e by Mark Thomas) was already present in the upstream 9.0.83 release, which serves as the base for this TuxCare branch. The JsonErrorReportValve properly escapes type, message, and description fields using JSONFilter.escape() before embedding them in JSON output, preventing the JSON injection vulnerability. The CVE affects versions 9.0.40 to 9.0.68; this version (9.0.83) is outside the affected range.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-24998",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.83-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:ff74cca1-740b-54bd-b3f1-8b68399f22a2",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-24998 does not affect version 9.0.83-tuxcare.6 of org.apache.tomcat:tomcat-catalina. Apache Tomcat 9.0.83 is not affected by CVE-2023-24998. The fix for unlimited file upload parts (DoS vulnerability) was already present in the upstream Apache Tomcat 9.0.83 release. The fix adds fileCountMax limiting in FileUploadBase and wires it through Request.java to enforce maxParameterCount (default: 10,000). The vulnerable code pattern (unbounded iteration over multipart parts) is not present because the upstream fix (commit cf77cc545d by markt@apache.org, Dec 2022) was included in the 9.0.83 release (Nov 2023) before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71), cve.org (= 11.0.0-M1; >= 10.0.0-M1, <= 10.1.4; >= 9.0.0-M1, <= 9.0.70; >= 8.5.0, <= 8.5.84), Snyk (>= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3; >= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3; >= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-28708",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.83-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:a976d3b5-fa5c-53d8-b541-46841b82eb8f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-28708 does not affect version 9.0.83-tuxcare.6 of org.apache.tomcat:tomcat-catalina. not_affected \u2014 Target version 9.0.83 is NOT AFFECTED. The vulnerability (CVE-2023-28708) affected Tomcat 9.0.0-M1 to 9.0.71. The fix (commit 3b51230764, Bug 66471) was authored by upstream Apache developer lihan@apache.org and shipped in upstream Tomcat releases after 9.0.71. Version 9.0.83 already contains this upstream fix - the vulnerable pattern (RemoteIpFilter storing secure flag in local wrapper field i...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-41080",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.83-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:3fc9728e-a186-53a8-9b7d-7782488bb04c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-41080 does not affect version 9.0.83-tuxcare.6 of org.apache.tomcat:tomcat-catalina. not_affected \u2014 CVE-2023-41080 (open redirect in FORM authentication) is NOT present in the target. The vulnerability was already fixed in the upstream Apache Tomcat 9.0.83 release before TuxCare onboarded this version. The fix commit 77c0ce2d16 by Mark Thomas (markt@apache.org) was applied on 2023-08-22, before the 9.0.83 release tag on 2023-11-09. The fix is present at FormAuthenticator.java:761-764, which s...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-42795",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.83-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:8ee11ad4-1f10-5b3b-b77e-df0c53be71fb",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-42795 does not affect version 9.0.83-tuxcare.6 of org.apache.tomcat:tomcat-catalina. not_affected \u2014 CVE-2023-42795 fix is already present in the target repository. The vulnerability addresses incomplete cleanup during object recycling that could leak information between requests. The fix, authored by Mark Thomas (markt@apache.org) in upstream commit 44d05d75d696ca10ce251e4e370511e38f20ae75, was included in Apache Tomcat 9.0.81 and is present in the target's base version 9.0.83. All four affec...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-46589",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.83-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:aad287c5-79f0-5530-85c5-5256e03a0d15",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-46589 does not affect version 9.0.83-tuxcare.6 of org.apache.tomcat:tomcat-catalina. CVE-2023-46589 is not present in target Tomcat 9.0.83. The vulnerability involves improper parsing of HTTP trailer headers that could lead to request smuggling. The fix, which adds character validation for trailer header names and values in ChunkedInputFilter.java, was included in the upstream Apache Tomcat 9.0.83 release (November 2023) via commit 59583245639d by Mark Thomas. The target repository is based on this upstream release and inherits the fix. The vulnerable code pattern (missing validation) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M11; >= 10.1.0-M1, < 10.1.16; >= 9.0.0-M1, < 9.0.83; >= 8.5.0, < 8.5.96; >= 11.0.0-M1, < 11.0.0-M11; >= 10.1.0-M1, < 10.1.16; >= 9.0.0-M1, < 9.0.83; >= 8.5.0, < 8.5.96; >= 11.0.0-M1, < 11.0.0-M11), NVD (>= 8.5.0, < 8.5.96; >= 9.0.0, < 9.0.83; >= 10.1.0, < 10.1.16; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.0-M10; >= 10.1.0-M1, <= 10.1.15; >= 9.0.0-M1, <= 9.0.82; >= 8.5.0, <= 8.5.95; >= 11.0.0-m1, <= 11.0.0-m10; >= 10.1.0-M1, <= 10.1.15; >= 9.0.0-M1, <= 9.0.82; >= 8.5.0, <= 8.5.95), Snyk (>= 8.5.0, < 8.5.96; >= 9.0.0-M1, < 9.0.83; >= 10.1.0-M1, < 10.1.16; >= 11.0.0-M1, < 11.0.0-M10; >= 8.5.0, < 8.5.96; >= 9.0.0-M1, < 9.0.83; >= 10.1.0-M1, < 10.1.16; >= 11.0.0-M1, < 11.0.0-M10).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-50379",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.83-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:218798e8-6160-5775-896e-1241f61c4776",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-50379 is fixed in version 9.0.83-tuxcare.6 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2024-52316",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.83-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:51cb0988-d330-5a35-94c7-b8ffd9e2be0e",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-52316 is fixed in version 9.0.83-tuxcare.6 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2024-56337",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.83-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:4fe1a7e7-9844-5974-a30b-fbedabbacc83",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-56337 is fixed in version 9.0.83-tuxcare.6 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2025-24813",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.83-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:c813d4df-1962-505f-99af-4d9a2597c221",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-24813 is fixed in version 9.0.83-tuxcare.6 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2025-31651",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.83-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:e386e15f-9444-5849-b0fd-3c5a5d72e209",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-31651 is fixed in version 9.0.83-tuxcare.6 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2025-46701",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.83-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:a286c68b-cc1f-5fd7-9f52-ebeb83193e52",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-46701 is fixed in version 9.0.83-tuxcare.6 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2025-48988",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.83-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:ec4fe397-ee46-5a69-af29-3434857eb67f",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-48988 is fixed in version 9.0.83-tuxcare.6 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2025-49124",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.83-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:b5640d47-0efb-5b61-b743-dc90a3eba092",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-49124 is fixed in version 9.0.83-tuxcare.6 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2025-49125",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.83-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:80df06f1-8298-5f56-9c37-4c1d5b9e1651",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-49125 is fixed in version 9.0.83-tuxcare.6 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2025-52520",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.83-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:6fc75894-d52d-5721-ab30-27f3ba54de03",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-52520 is fixed in version 9.0.83-tuxcare.6 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2025-55668",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.83-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:edf2d01f-557f-5d1a-bda9-dab36149e7f6",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-55668 is fixed in version 9.0.83-tuxcare.6 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2025-55752",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.83-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:71ec4984-2ae6-5fc0-a276-5db279a486b5",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-55752 affects version 9.0.83-tuxcare.6 of org.apache.tomcat:tomcat-catalina, and is fixed in 9.0.83-tuxcare.7."
      }
    },
    {
      "id": "CVE-2025-55754",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.83-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:81fff137-19cd-5c6b-a053-5d6508460260",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-55754 is fixed in version 9.0.83-tuxcare.6 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2025-61795",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.83-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:95643172-abdc-535d-99cb-d2dc2ed4d55e",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-61795 is fixed in version 9.0.83-tuxcare.6 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2026-25854",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.83-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:0e975396-84c0-5995-9f2c-c90a6e1fb695",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-25854 is fixed in version 9.0.83-tuxcare.6 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2026-34483",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.83-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:2c71b80a-e75e-5014-8a00-eb24437fb028",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-34483 is fixed in version 9.0.83-tuxcare.6 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2026-41284",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.83-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:9998c470-d5ae-5f2d-b02a-1ec13efc1aac",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41284 affects version 9.0.83-tuxcare.6 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2026-42498",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.83-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:6e143874-0a5a-5d21-9b1d-e2f953316189",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42498 affects version 9.0.83-tuxcare.6 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2026-43512",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.83-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:5d5a9843-3d85-5d47-a551-1dfe70c88a7e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-43512 affects version 9.0.83-tuxcare.6 of org.apache.tomcat:tomcat-catalina, and is fixed in 9.0.83-tuxcare.7."
      }
    },
    {
      "id": "CVE-2026-43513",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.83-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:9fcc008e-3b03-539c-9570-ff770051527a",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-43513 affects version 9.0.83-tuxcare.6 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2026-43514",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.83-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:3c859030-aa76-5d7b-a9cb-10a0e48b4ecf",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-43514 affects version 9.0.83-tuxcare.6 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2026-43515",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.83-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:88db62eb-7e85-578a-87bb-cb4c1cdc057c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-43515 affects version 9.0.83-tuxcare.6 of org.apache.tomcat:tomcat-catalina, and is fixed in 9.0.83-tuxcare.7."
      }
    },
    {
      "id": "CVE-2026-53404",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.83-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:fe51f63e-bbea-5f36-9a63-2aea917feac7",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-53404 affects version 9.0.83-tuxcare.6 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2026-55956",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.83-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:775c7522-d257-5a44-a562-37dc502f4d93",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-55956 affects version 9.0.83-tuxcare.6 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2026-55957",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.83-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:f5f0605c-f016-5d11-8af3-c10f12c8a85e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-55957 affects version 9.0.83-tuxcare.6 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2026-65182",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.83-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:3ade3602-e107-59c0-812a-c34987f4550f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-65182 affects version 9.0.83-tuxcare.6 of org.apache.tomcat:tomcat-catalina."
      }
    },
    {
      "id": "CVE-2026-65905",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.83-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:af49d279-22ef-51d2-bc7c-1580e1613a65",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-65905 affects version 9.0.83-tuxcare.6 of org.apache.tomcat:tomcat-catalina, and is fixed in 9.0.83-tuxcare.7."
      }
    },
    {
      "id": "CVE-2026-68525",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.83-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:d998e23b-0f4b-5b73-83ca-c34e8c7fd09a",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-68525 affects version 9.0.83-tuxcare.6 of org.apache.tomcat:tomcat-catalina."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.83-tuxcare.6"
    }
  ]
}