{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:af75e400-f5cb-5c91-b6b3-38d6faf80830", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat-coyote", "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.7", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.7", "version": "7.0.109-tuxcare.7", "pedigree": { "ancestors": [ { "name": "tomcat-coyote", "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109", "type": "library", "group": "org.apache.tomcat", "version": "7.0.109" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-0095", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:d661b16b-aee6-5b97-8656-dbea5bd43ae1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0095 does not affect version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 CVE-2014-0095 affects only Apache Tomcat 8.x before 8.0.4. The vulnerability was a regression introduced in Tomcat 8.0.0-RC2 as part of Servlet 3.1 non-blocking I/O support. Tomcat 7.0.109 implements Servlet 3.0 and does not contain the Servlet 3.1 non-blocking I/O code that introduced this regression. The target uses a simpler AJP processor architecture that handles Content-Length: 0 requests ...", "justification": "code_not_present" } }, { "id": "CVE-2016-6816", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:5f401e4d-e365-51d1-945d-9156927054f5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-6816 does not affect version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat-coyote. Version 7.0.109 is not vulnerable. Summary: CVE-2016-6816 is NOT present in this target repository. The target is running Apache Tomcat 7.0.109, which includes the fix introduced in version 7.0.73. The fix adds stricter character validation for HTTP request line parsing using HttpParser.isToken(), HttpParser.isNotRequestTarget(), and HttpParser.isHttpProtocol() methods.", "justification": "code_not_present" } }, { "id": "CVE-2017-5651", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:c63bc438-268d-5847-917d-66b40c3d46df", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-5651 does not affect version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat-coyote. CVE-2017-5651 affects Apache Tomcat 8.5.0-8.5.12 and 9.0.0.M1-9.0.0.M18 only; 7.0.x is not affected", "justification": "code_not_present" } }, { "id": "CVE-2019-0199", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:1681a254-5d92-57b7-b79d-ddf51a35ebbc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-0199 affects version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2020-13934", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:be272595-1543-5104-9116-1eb6cd132479", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-13934 does not affect version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat-coyote. CVE-2020-13934 affects Apache Tomcat 8.5.1-8.5.56 and 9.0.0.M5-9.0.36 only; 7.0.x is not affected", "justification": "code_not_present" } }, { "id": "CVE-2020-13943", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:cc482faf-8ef1-5893-92ad-ab6d1fc2f5df", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-13943 affects version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2020-17527", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:13c1d597-89b4-5028-8f4c-b134fa61e977", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-17527 affects version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2021-25122", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:b78d90f4-4397-58aa-a752-6da292744bf6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-25122 affects version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2022-42252", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:b4994165-e4f9-56ed-9999-d23d77e03cca", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-42252 affects version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-24998", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:18c3547f-2d90-5d26-b673-aca9f49423c9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-24998 affects version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-28709", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:303061b5-6577-5b50-a703-4e528e1b1d16", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-28709 is fixed in version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-34981", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:b47831b6-fe44-5baa-a991-98889d13833e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-34981 does not affect version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat-coyote. Prechecker: No vulnerable code from the fix was found; the method the fix changes and its callers are absent, and the code the fix removes is gone. Version 7.0.109 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-mppv-79ch-vw6q (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (newer lines only).", "justification": "code_not_present" } }, { "id": "CVE-2023-42794", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:b8be47ca-5e67-5cad-b25a-8554d69b4989", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-42794 does not affect version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 Apache Tomcat 7.0.109 is NOT affected by CVE-2023-42794. The vulnerability was introduced in later versions (9.0.70-9.0.80, 8.5.85-8.5.93) when refactoring removed the finalize() cleanup method from DiskFileItem. Tomcat 7.0.109 has always had the finalize() method (lines 543-553) that provides the defense against temporary file accumulation. This method was present in the upstream Tomcat 7.0.10...", "justification": "code_not_present" } }, { "id": "CVE-2023-44487", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:2926817d-6f1e-5c38-a9dc-4a259ed5e6ed", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-44487 affects version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-45648", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:4bf71867-1b84-517b-8f4e-4c3b61115fed", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-45648 affects version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-46589", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:642bad22-238f-5297-8af9-8c6ec2b59d87", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-46589 is fixed in version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-21733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:8d62a637-092b-558a-9bfa-02285476358b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-21733 does not affect version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat-coyote. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because its input buffers prevent stale request data from entering error messages. NIO resets valid bounds before body reads and exposes only positively counted bytes (java/org/apache/coyote/http11/InternalNioInputBuffer.java:860; java/org/apache/coyote/http11/InternalNioInputBuffer.java:479). Error-message extraction stops at the valid-data boundary, excluding unused buffer contents (java/org/apache/coyote/http11/AbstractInputBuffer.java:187).", "justification": "code_not_reachable" } }, { "id": "CVE-2024-24549", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:8600d110-faa3-534f-bad5-a9645b8853c2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-24549 affects version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-34750", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:19da0f3e-a42d-563b-bd50-d6a0a05a7a90", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-34750 affects version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-38286", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:208492f3-c3b9-55a8-8638-f8a6bbfd0482", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38286 affects version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-52317", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:310e04b9-27c5-59df-a022-e511b0da1a84", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-52317 does not affect version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 CVE-2024-52317 does not affect Tomcat 7.0.109 because this version does not support HTTP/2. The vulnerability is specific to HTTP/2 stream recycling logic in the org.apache.coyote.http2 package, which does not exist in Tomcat 7.x. HTTP/2 support was introduced in Tomcat 8.5 and later versions. The target only implements HTTP/1.1 and AJP protocols. Exhaustive search confirmed zero HTTP/2 code pr...", "justification": "code_not_present" } }, { "id": "CVE-2025-31650", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:a07a0f2a-565c-5dcb-98f2-ea12e7c5b4de", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31650 affects version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2025-48989", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:bd832b33-f739-5e13-85e4-85950a29eae3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-48989 affects version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2025-52434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:842072c8-76d9-5377-8f1c-3de39c0a2c3d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-52434 affects version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2025-53506", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:f3d934ab-4673-556b-989a-5f236a8b4be8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-53506 affects version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2025-66614", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:0d258863-bc1f-5c3c-abaa-aca198017680", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66614 affects version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-24733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:d968da3c-d8e8-5746-90b8-2c8658c1ce33", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-24733 is fixed in version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-24734", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:7550737b-621b-5179-b86b-386f4302842a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24734 affects version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-24880", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:196b99b0-d128-51ba-b6c2-b3bc8f834f53", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-24880 is fixed in version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-29129", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:5c85aeea-2335-58bf-b942-724a779c59a9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-29129 does not affect version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 Apache Tomcat 7.0.109 is NOT AFFECTED by CVE-2026-29129. The vulnerability exists in SSLHostConfig.java's getJsseCipherNames() method which uses HashSet (losing cipher order). Version 7.0.109 does not have SSLHostConfig.java - it uses an older architecture (JSSESocketFactory) that processes ciphers with ArrayList, which preserves the configured order. The vulnerable code pattern was introduced ...", "justification": "code_not_present" } }, { "id": "CVE-2026-32990", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:c8b2aba1-746b-5015-86c0-6b1e32d7e7b2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-32990 affects version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-41293", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:3a373b2b-e93a-5bae-b563-91bbec350dfc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41293 affects version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-65637", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:1f59d955-00e3-51c6-97be-7ff7323c1e4a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65637 does not affect version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat-coyote. Prechecker: No vulnerable code from the fix was found; the fixed code and the component it belongs to are absent from this version. Version 7.0.109 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-f525-44xv-f2qj (newer lines only), NVD (newer lines only), CVE record (newer lines only).", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@7.0.109-tuxcare.7" } ] }