{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:60320e49-fb49-57d6-a929-928e53b0aa7e",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "tomcat-coyote",
      "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.78-tuxcare.1",
      "type": "library",
      "group": "org.apache.tomcat",
      "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.78-tuxcare.1",
      "version": "8.5.78-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "tomcat-coyote",
            "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.78",
            "type": "library",
            "group": "org.apache.tomcat",
            "version": "8.5.78"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2014-0095",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.78-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:30cecac1-9681-573a-9038-d5505a48bd2e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2014-0095 does not affect version 8.5.78-tuxcare.1 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 CVE-2014-0095 affects Apache Tomcat 8.x before 8.0.4, causing DoS via Content-Length: 0 AJP requests that trigger thread hangs. The target version 8.5.78 already contains the upstream fix committed by Mark Thomas (markt@apache.org) on 2014-03-17 in commit 1bd7d41498. This fix was shipped in the upstream 8.5.78 release that TuxCare onboarded. The fix explicitly handles contentLength == 0 by sett...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-6816",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.78-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:c955c94e-9991-544d-8011-cf29bb209d90",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-6816 does not affect version 8.5.78-tuxcare.1 of org.apache.tomcat:tomcat-coyote. CVE-2016-6816 is NOT present in Apache Tomcat 8.5.78. The vulnerability affected versions 8.5.0-8.5.6, allowing invalid characters in HTTP request lines to enable response splitting attacks. The upstream fix by Mark Thomas (commit f96f5751d41, Nov 2016) added character validation via HttpParser.isNotRequestTarget() and HttpParser.isHttpProtocol() methods. These validations are present and active in the target at Http11InputBuffer.java lines 510 and 583, rejecting invalid characters before they reach response generation. The fix was already included in the upstream Apache Tomcat 8.5.78 release that TuxCare onboarded (commit fb98844404), making this an upstream-authored fix rather than a TuxCare backport.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-5651",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.78-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:3bc9add8-deb0-5ba7-8309-06c3d224ef36",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-5651 does not affect version 8.5.78-tuxcare.1 of org.apache.tomcat:tomcat-coyote. The target Apache Tomcat 8.5.78 is NOT affected by CVE-2017-5651. The vulnerability (sendfile processor cache corruption leading to response mix-up) was fixed by upstream Apache developer Mark Thomas in commit 494429ca21 (bug 60918) dated March 24, 2017. This fix was already present in the upstream Apache Tomcat 8.5.78 release that TuxCare onboarded, as confirmed by git ancestry analysis showing the fix commit predates the TuxCare onboarding commit fb98844404 by 3599 commits. Code inspection confirms all fix elements are correctly implemented: SendfileState tracking variable, modified loop condition, processSendfile() method returning state, and removal of premature sendfileData clearing from prepareRequest().",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2019-0199",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.78-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:df4555e1-81f7-5f95-bc5f-bbbfd44194d0",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-0199 does not affect version 8.5.78-tuxcare.1 of org.apache.tomcat:tomcat-coyote. CVE-2019-0199 affects Apache Tomcat 8.5.0 to 8.5.37. The target is version 8.5.78-tuxcare.3, which is based on upstream 8.5.78 released after the affected range. The vulnerability (DoS via excessive HTTP/2 SETTINGS frames and indefinite stream blocking) was fixed by upstream Apache in commits 2c5939e1, 69c57c8c, 19bebdec, and 65f4b6d1 authored by Mark Thomas. All four fixes are present in the target: stream-level read/write timeouts (DEFAULT_STREAM_READ_TIMEOUT=20000ms, DEFAULT_STREAM_WRITE_TIMEOUT=20000ms in Http2Protocol.java), timeout enforcement in Stream.java (lines 1063-1075 for read, 215-220 for write), and overhead frame counting in Http2UpgradeHandler.java (lines 157, 358, 1761, 1854, 1903). These fixes shipped in the upstream 8.5.78 release that TuxCare onboarded (commit fb98844404 by amoniatovskiy@cloudlinux.com). The vulnerable code patterns are not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38; >= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38), NVD (>= 8.5.0, <= 8.5.37; >= 9.0.1, <= 9.0.14; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.14; >= 8.5.0, <= 8.5.37), Snyk (>= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-13934",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.78-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:cd405702-b663-5fa0-9935-8cc359b24f21",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-13934 does not affect version 8.5.78-tuxcare.1 of org.apache.tomcat:tomcat-coyote. Target version 8.5.78 is not affected by CVE-2020-13934. The vulnerability (failure to release HTTP/1.1 processor after h2c upgrade leading to memory exhaustion) was fixed in upstream Apache Tomcat by commit 923d834500 authored by Mark Thomas (markt@apache.org). This fix was included in the upstream 8.5.78 release, which is newer than the last affected version (8.5.56). The target repository contains the complete fix: the HTTP/1.1 processor is properly released via `release(processor)` before creating the HTTP/2 upgrade processor, and the control flow correctly uses `state = SocketState.CLOSED` to trigger cleanup.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-13943",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.78-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:be2ef2eb-dc1d-5608-8480-dd797806d95c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-13943 does not affect version 8.5.78-tuxcare.1 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 Apache Tomcat 8.5.78 is not affected by CVE-2020-13943. The upstream fix was already present in version 8.5.78 when TuxCare onboarded it. The CVE affects versions 8.5.0 to 8.5.57; this is 8.5.78. The vulnerability involved HTTP/2 header confusion when concurrent stream limits were exceeded due to checking limits during initial header parsing (headersStart) rather than after complete parsing (he...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-17527",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.78-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:84d05568-363c-5edf-ab41-74cb82f3e55e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-17527 does not affect version 8.5.78-tuxcare.1 of org.apache.tomcat:tomcat-coyote. Target version 8.5.78 is NOT AFFECTED. CVE-2020-17527 affects Apache Tomcat 8.5.0 to 8.5.59 due to shared mutable state in the HTTP/2 HPACK decoder causing header value leakage between concurrent streams. The vulnerability was fixed in upstream version 8.5.60 by commit 21e3408671 (authored by Mark Thomas). Target 8.5.78 was onboarded by TuxCare with the fix already present from the upstream release. All three related fixes are present: HpackDecoder uses local StringBuilder (not shared), ConnectionSettingsBase uses ConcurrentHashMap (not EnumMap), and AbstractProtocol correctly handles leftover input during HTTP/2 upgrade.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M10; >= 9.0.0-M1, < 9.0.40; >= 8.5.0, < 8.5.60), NVD (>= 8.5.1, <= 8.5.59; >= 9.0.1, <= 9.0.35; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 9.0.35-3.39.1; = 9.0.35-3.57.3; = 9.0.36; = 9.0.37; = 9.0.38; = 9.0.39; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10.0.0-M1, <= 10.0.0-M9; = 10; >= 9.0.0-M1, <= 9.0.39; = 9; >= 8.5.0, <= 8.5.59; = 8.5), Snyk (<= 0; >= 8.5.0, < 8.5.60; >= 9.0.0, < 9.0.40; >= 10.0.0-M1, < 10.0.0-M10).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-25122",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.78-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:5c42c6fa-43dc-595f-aa3b-14b330a588bf",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-25122 does not affect version 8.5.78-tuxcare.1 of org.apache.tomcat:tomcat-coyote. The target Apache Tomcat 8.5.78 is not affected by CVE-2021-25122. The vulnerability affected versions 8.5.0 to 8.5.61, and all required fixes for bug 64830 are present in the target code. The fixes were authored by upstream Apache (Mark Thomas) and shipped with the 8.5.78 release that TuxCare onboarded. The vulnerable patterns (shared StringBuilder in HpackDecoder, non-thread-safe EnumMap in ConnectionSettingsBase, and improper processor lifecycle management) are not present in the current codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.2; >= 9.0.0-M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 10.0.0-M1, < 10.0.2), NVD (>= 8.5.0, <= 8.5.61; >= 9.0.0, <= 9.0.41; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 10.0.0; = 10.0.0-milestone1; = 10.0.0-milestone10; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10, < 10.0.2; >= 9, < 9.0.42; >= 8.5, < 8.5.62), Snyk (>= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; <= 0).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-42252",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.78-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:64bd6398-e020-5095-8a2b-b065273b098b",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-42252 is fixed in version 8.5.78-tuxcare.1 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2023-24998",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.78-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:4b80ee2b-367d-5107-8c00-1b827c6125c0",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-24998 affects version 8.5.78-tuxcare.1 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2023-28709",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.78-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:4e18281a-8154-589f-b2f1-c16783e683aa",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-28709 affects version 8.5.78-tuxcare.1 of org.apache.tomcat:tomcat-coyote, and is fixed in 8.5.78-tuxcare.4."
      }
    },
    {
      "id": "CVE-2023-34981",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.78-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:cfd8f15a-987b-5444-8a69-d76d74075eb1",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-34981 affects version 8.5.78-tuxcare.1 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2023-42794",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.78-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:41271913-6dd4-5a40-9d79-7e1579b0071d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-42794 does not affect version 8.5.78-tuxcare.1 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 Apache Tomcat 8.5.78-tuxcare.3 is not affected by CVE-2023-42794. The vulnerability was introduced by a refactoring in version 8.5.85 that removed the finalize() cleanup method from DiskFileItem.java. Since the target version (8.5.78) predates this refactoring, it retains the original finalize() method (lines 538-548) that provides automatic cleanup of temporary uploaded files during garbage co...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-44487",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.78-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:84e5eeb9-a87b-5245-b87e-c2aabecf762c",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2023-44487 is fixed in version 8.5.78-tuxcare.1 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2023-45648",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.78-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:0401c652-b13b-5fae-92ae-b5002e1676db",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-45648 affects version 8.5.78-tuxcare.1 of org.apache.tomcat:tomcat-coyote, and is fixed in 8.5.78-tuxcare.5."
      }
    },
    {
      "id": "CVE-2023-46589",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.78-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:14f6f330-737a-504a-8f3b-180dfda3cb25",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-46589 affects version 8.5.78-tuxcare.1 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2024-21733",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.78-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:e5d2d6c8-2056-5e5a-bd90-1f64a3afdcd9",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-21733 does not affect version 8.5.78-tuxcare.1 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 CVE-2024-21733 affects Apache Tomcat 8.5.7 through 8.5.63. The target is version 8.5.78, which already contains the upstream fix introduced in version 8.5.64. The vulnerability involved generating error messages containing sensitive internal server state when attempting I/O operations on closed connections. The fix (commit 0ff1ed325d2) adds IS_IO_ALLOWED checks in ErrorReportValve.java to preve...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-24549",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.78-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:74ba2c15-199e-51fb-8377-a28ddf59b2f5",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-24549 affects version 8.5.78-tuxcare.1 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2024-34750",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.78-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:e90c580f-6aa8-50ef-be10-e3cf48eaa0c9",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-34750 affects version 8.5.78-tuxcare.1 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2024-38286",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.78-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:ea5be64c-6038-54c8-a6f1-3aaa67d39150",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-38286 affects version 8.5.78-tuxcare.1 of org.apache.tomcat:tomcat-coyote, and is fixed in 8.5.78-tuxcare.2."
      }
    },
    {
      "id": "CVE-2024-52317",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.78-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:324cd794-18e9-5d41-b36f-02909ce2a99d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-52317 does not affect version 8.5.78-tuxcare.1 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 Apache Tomcat 8.5.78 is NOT affected by CVE-2024-52317. While the target version has HTTP/2 support and the Stream.recycle() method that could be called multiple times during error conditions, it lacks the request/response pooling mechanism that enables the vulnerability. In version 8.5.78, each Stream creates its own dedicated Request and Response objects (as final fields) that are never poole...",
        "justification": "code_not_reachable"
      }
    },
    {
      "id": "CVE-2025-31650",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.78-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:9b69d204-1bd2-5105-ae88-70d0ab248701",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-31650 does not affect version 8.5.78-tuxcare.1 of org.apache.tomcat:tomcat-coyote. Apache Tomcat 8.5.78 is NOT AFFECTED by CVE-2025-31650. This vulnerability requires RFC 9218 HTTP Extensible Priorities support, which was not introduced until version 8.5.90. Version 8.5.78 lacks the Priority class, PRIORITY_UPDATE frame type, readPriorityUpdateFrame() method, and all priority header parsing code that contains the vulnerability. The CVE's affected version range (8.5.90-8.5.100) correctly excludes 8.5.78.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-48989",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.78-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:12c949c2-1bab-5eaf-983c-650d3edcf89e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-48989 affects version 8.5.78-tuxcare.1 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2025-52434",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.78-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:e11472f7-cf01-5da5-a966-f735c103b5f9",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-52434 affects version 8.5.78-tuxcare.1 of org.apache.tomcat:tomcat-coyote, and is fixed in 8.5.78-tuxcare.2."
      }
    },
    {
      "id": "CVE-2025-53506",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.78-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:8a4d156c-915e-5904-8a19-46986a03ef42",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-53506 affects version 8.5.78-tuxcare.1 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2025-66614",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.78-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:488240b3-8a5e-572f-9bbb-8ce98bf729be",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-66614 affects version 8.5.78-tuxcare.1 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2026-24733",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.78-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:53021023-951b-50fa-ba5f-ac9fffb92e76",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-24733 is fixed in version 8.5.78-tuxcare.1 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2026-24734",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.78-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:6cee61f6-bb88-5dbd-9144-481d91375d8d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-24734 affects version 8.5.78-tuxcare.1 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2026-24880",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.78-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:05d54813-a533-53de-ad91-417e62753b4d",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-24880 is fixed in version 8.5.78-tuxcare.1 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2026-29129",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.78-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:1ad704fe-eb17-5b49-a3a3-7bc2bcb95a37",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-29129 does not affect version 8.5.78-tuxcare.1 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 Apache Tomcat 8.5.78 is not affected by CVE-2026-29129. The vulnerability was introduced in later versions (9.0.114+, 10.1.51+, 11.0.16+) when TLS 1.3 cipher suite support was added. Version 8.5.78 lacks the TLS 1.3 cipher suite merging code that used HashSet instead of LinkedHashSet, causing cipher order to not be preserved. The target version uses a simpler code path that already preserves ci...",
        "justification": "code_not_reachable"
      }
    },
    {
      "id": "CVE-2026-32990",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.78-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:d23a4fe1-3216-505b-b71b-0879ebcf1960",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-32990 does not affect version 8.5.78-tuxcare.1 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 Apache Tomcat 8.5.78 is not affected by CVE-2026-32990. The vulnerability requires the checkSni() method introduced in CVE-2025-66614, which was backported to version 8.5.100. Version 8.5.78 predates this feature and lacks the vulnerable code path entirely. The SNI validation framework that compares protocol hostname with SNI hostname does not exist in 8.5.78.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-41293",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.78-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:b12b4496-ff1a-5337-b04c-191175bbb9f3",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41293 affects version 8.5.78-tuxcare.1 of org.apache.tomcat:tomcat-coyote."
      }
    },
    {
      "id": "CVE-2026-65637",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.78-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:8cbf89f4-c7dd-5c12-ad6a-60ab65d942d2",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-65637 does not affect version 8.5.78-tuxcare.1 of org.apache.tomcat:tomcat-coyote. Prechecker: No vulnerable code from the fix was found, and this version implements the code the fix changes differently from upstream. Version 8.5.78 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-f525-44xv-f2qj (newer lines only), NVD (newer lines only), CVE record (newer lines only).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.78-tuxcare.1"
    }
  ]
}