{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:e2be1348-4232-5d9b-a819-7a99bd928dba", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat-coyote", "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1", "version": "9.0.24-tuxcare.1", "pedigree": { "ancestors": [ { "name": "tomcat-coyote", "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24", "type": "library", "group": "org.apache.tomcat", "version": "9.0.24" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-0095", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:75c201bb-cb3a-504b-881e-eee04b008341", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0095 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 CVE-2014-0095 is not present in Apache Tomcat 9.0.24. The vulnerability affected Tomcat 8.x before 8.0.4, where Content-Length: 0 AJP requests caused thread hangs. The fix was applied by Mark Thomas (markt@apache.org) on March 17, 2014 in commit 8884dae60a, and was included in the upstream Tomcat 9.0.24 release. The current code properly handles Content-Length: 0 by setting endOfStream=true and...", "justification": "code_not_present" } }, { "id": "CVE-2016-6816", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:953c46a3-6ad2-5b4e-85df-e48d3eff0562", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-6816 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. The upstream fix was released in 9.0.0.M12, and version 9.0.24 is a later release of the same line. Advisories: GitHub GHSA-jc7p-5r39-9477 (fixed in 9.0.0.M12), NVD (last affected 9.0.0-milestone11), CVE record (last affected 9.0.0.M11), Snyk (fixed in 9.0.0.M13).", "justification": "code_not_present" } }, { "id": "CVE-2017-5651", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:864be1ed-46b1-5809-8d36-653eb1945ef8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-5651 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote. CVE-2017-5651 affects Apache Tomcat 9.0.0.M1 to 9.0.0.M18. The target version 9.0.24 (released August 2019) is not affected because the upstream vendor (Apache) fixed this vulnerability in March 2017 (bug 60918) before releasing 9.0.24. All fix components are present in the target code: SendfileState tracking, modified keep-alive loop condition, processSendfile() method, and removed sendfileData clearing in prepareRequest(). The fix was already present in the upstream 9.0.24 release when TuxCare onboarded it via commit 9c7e71d9ac.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12), Snyk (>= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19).", "justification": "code_not_present" } }, { "id": "CVE-2019-0199", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:74836e40-a37a-5a09-b5d0-b3fcd7dad806", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-0199 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote. Apache Tomcat 9.0.24 is not affected by CVE-2019-0199. The vulnerability affected versions 9.0.0.M1 to 9.0.14, and all fixes (stream timeouts and overhead frame counting) were applied to the upstream Apache Tomcat codebase on February 1, 2019, before the 9.0.24 release on August 14, 2019. The target version ships with these protections enabled by default: stream read/write timeouts of 20 seconds and active overhead counting with factor 1. The vulnerable pattern (indefinite wait() calls without timeouts and absent overhead tracking) is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38; >= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38), NVD (>= 8.5.0, <= 8.5.37; >= 9.0.1, <= 9.0.14; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.14; >= 8.5.0, <= 8.5.37), Snyk (>= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16).", "justification": "code_not_present" } }, { "id": "CVE-2020-13934", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:b23aff51-2be0-5e8e-8030-153e3075f205", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-13934 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2020-13943", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:8306b6bb-53ea-5723-b54d-fb1f2bca90f2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-13943 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2020-17527", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:1e62118e-20a0-5926-a625-638936c43d5d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-17527 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2021-25122", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:acf96c23-2701-56a4-801d-5cf7ad88e384", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-25122 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2022-42252", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:00a36a61-6a55-57b0-89dc-6a2d38693ced", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-42252 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-24998", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:f16512e6-dc8d-5a98-9ae1-9c8f1d4137f3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-24998 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-28709", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:6c3d8810-cec5-53e1-a636-4de4cdd9f572", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-28709 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-34981", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:87dcf5fb-e7a1-5dea-becd-78179ca88814", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-34981 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-42794", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:50e75771-9823-5f03-bd03-bc8d032dfffc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-42794 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 Target version 9.0.24 is NOT AFFECTED by CVE-2023-42794. The vulnerability was introduced in versions 9.0.70-9.0.80 when an \"in progress refactoring\" removed the finalize() cleanup method from DiskFileItem.java. Version 9.0.24 predates this refactoring and still contains the original finalize() method (lines 549-558) that prevents temporary uploaded files from persisting indefinitely. The CVE a...", "justification": "code_not_present" } }, { "id": "CVE-2023-44487", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:d9d7d9cd-5f0a-5f55-af56-5f05a2e6224d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-44487 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-45648", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:4ea7887b-8689-583c-981b-a590796a4d35", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-45648 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-46589", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:42922256-20e0-52e2-b518-96dea9e3da11", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-46589 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-21733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:1626b47f-be41-5569-b801-70a07ae05eb3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-21733 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-24549", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:46797c2b-6185-5b6b-b152-e9eaa5b394d4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-24549 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-34750", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:bc02170c-5802-5fbd-8a57-e845ab5d7154", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-34750 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-38286", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:dbe2bdbc-6886-5343-bd4d-6d73e0680b9c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38286 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-52317", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:1fb15a9e-74ba-572a-98a8-cf382b90acf9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-52317 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 Apache Tomcat 9.0.24 is not affected by CVE-2024-52317. The vulnerable HTTP/2 request/response recycling mechanism does not exist in this version. The recycling feature was introduced in version 9.0.92 (commit 3c5b14b713, July 24, 2024), and the CVE explicitly states it affects versions 9.0.92-9.0.95. Since 9.0.24 predates the introduction of this feature by 68 versions, the vulnerability canno...", "justification": "code_not_present" } }, { "id": "CVE-2025-31650", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:93d85153-3b0e-5439-b772-64ca620a22f4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-31650 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote. Apache Tomcat 9.0.24 is not affected by CVE-2025-31650. The vulnerability affects HTTP/2 extensible priorities (RFC 9218) support, which was not implemented in this version. The target lacks all vulnerable code paths: PRIORITY_UPDATE frame handling, Priority.parsePriority() method, and priority HTTP header processing. The CVE's affected version range starts at 9.0.76, consistent with RFC 9218 support being added after 9.0.24.", "justification": "code_not_present" } }, { "id": "CVE-2025-48989", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:721f3334-1e45-5c38-8ca1-dc00781cc576", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48989 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2025-52434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:d8a04b6f-ae78-5d0a-a398-1b2822c68df6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-52434 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2025-53506", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:49d1379b-26bc-58fb-bc5c-4497032fd285", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-53506 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2025-66614", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:b4b6c3ff-5283-5981-913b-516c526cce42", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66614 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-24733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:963e98e3-37cf-5686-acba-b9c8ba675d1c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-24733 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-24734", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:7439e944-0913-514d-bc35-18a65ad82c06", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24734 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-24880", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:780ab694-de4f-5836-aa3c-30ce7d41f203", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24880 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-29129", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:6194a15b-f618-527f-af06-de86295d6bc8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-29129 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 Target version 9.0.24 is not affected by CVE-2026-29129. The vulnerability concerns cipher preference order not being preserved when merging TLS 1.3 and regular cipher suites using HashSet. This issue was introduced when TLS 1.3 cipher configuration support was added (upstream commit 4ee45c5571, affects 9.0.114+) and fixed in commit 8d69b33764 by using LinkedHashSet. Version 9.0.24 predates the...", "justification": "code_not_present" } }, { "id": "CVE-2026-32990", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:b56a0342-a8b1-598c-9d78-60d27ec7d44c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-32990 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 CVE-2026-32990 affects the checkSni() method in AbstractEndpoint.java, which validates SNI hostnames against protocol-level host headers. This method was introduced by CVE-2025-66614 in Tomcat versions 9.0.113+, 10.1.50+, and 11.0.15+. The current target (version 9.0.24) predates this feature entirely - the checkSni() method, strictSni configuration, and SNI-vs-protocol-hostname validation logi...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-41293", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:1b9d35a7-1a4c-5a9f-9329-0f8b910fc5ef", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41293 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-65637", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:9470063e-2852-5c6c-a7d0-664feaeecfd5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65637 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.24-tuxcare.1" } ] }