{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:79dc030f-5b5c-5698-9776-b271102d8f46", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat-coyote", "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.46-tuxcare.14", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.46-tuxcare.14", "version": "9.0.46-tuxcare.14", "pedigree": { "ancestors": [ { "name": "tomcat-coyote", "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.46", "type": "library", "group": "org.apache.tomcat", "version": "9.0.46" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-0095", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.46-tuxcare.14" } ], "bom-ref": "urn:uuid:7922b18c-0e2a-54c1-b77e-126615a6c2a5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0095 does not affect version 9.0.46-tuxcare.14 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 CVE-2014-0095 affects Apache Tomcat 8.x before 8.0.4, causing DoS through thread consumption when processing AJP requests with Content-Length: 0. The target is Tomcat 9.0.46. The upstream fix (commit 8884dae60a by Mark Thomas, March 17, 2014) was already present in the upstream Tomcat 9.0.46 release before TuxCare onboarded it. The fix is present in HEAD at java/org/apache/coyote/ajp/AjpProcess...", "justification": "code_not_present" } }, { "id": "CVE-2016-6816", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.46-tuxcare.14" } ], "bom-ref": "urn:uuid:bc9ba9d3-51a8-5731-92d6-909693aacb35", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-6816 does not affect version 9.0.46-tuxcare.14 of org.apache.tomcat:tomcat-coyote. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. The upstream fix was released in 9.0.0.M12, and version 9.0.46 is a later release of the same line. Advisories: GitHub GHSA-jc7p-5r39-9477 (fixed in 9.0.0.M12), NVD (last affected 9.0.0-milestone11), CVE record (last affected 9.0.0.M11), Snyk (fixed in 9.0.0.M13).", "justification": "code_not_present" } }, { "id": "CVE-2017-5651", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.46-tuxcare.14" } ], "bom-ref": "urn:uuid:8fa2458e-af02-5d1d-a7d5-a648d0247786", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-5651 does not affect version 9.0.46-tuxcare.14 of org.apache.tomcat:tomcat-coyote. CVE-2017-5651 describes a race condition in Apache Tomcat's HTTP connector sendfile processing where the Processor could be added to cache twice, causing response mix-up between clients. The target Apache Tomcat 9.0.46 contains the complete upstream fix (commit 9233d9d6a0 from March 2017) that was already present in the Apache 9.0.46 release before TuxCare maintenance began. The fix captures sendfile state in a separate SendfileState variable before clearing sendfileData, preventing the race condition. All fix patterns are verified present: SendfileState tracking, processSendfile() method returning captured state, and removal of premature sendfileData clearing. The vulnerable pattern (checking sendfileData != null after it could be prematurely cleared) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12), Snyk (>= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19).", "justification": "code_not_present" } }, { "id": "CVE-2019-0199", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.46-tuxcare.14" } ], "bom-ref": "urn:uuid:9fe195ad-1612-5845-802a-c3958b51e240", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-0199 does not affect version 9.0.46-tuxcare.14 of org.apache.tomcat:tomcat-coyote. CVE-2019-0199 affects Apache Tomcat 9.0.0.M1 to 9.0.14. The target is Tomcat 9.0.46, which already includes all upstream fixes for this CVE. The vulnerability allowed DoS through excessive HTTP/2 control frames and streams without data transfer, causing thread exhaustion. The upstream patches added stream-level read/write timeouts and overhead frame tracking. All three defenses are present and enforced in the target: (1) stream write timeout at Stream.java:215-220, (2) stream read timeout at Stream.java:1057-1076, and (3) overhead tracking/enforcement at Http2UpgradeHandler.java:146,356-360. The fix was committed by Apache's Mark Thomas in February 2019 (commits c38033338a and f9d8c2591f), predating the Tomcat 9.0.46 release (March 2021) and the TuxCare onboarding (September 2025).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38; >= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38), NVD (>= 8.5.0, <= 8.5.37; >= 9.0.1, <= 9.0.14; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.14; >= 8.5.0, <= 8.5.37), Snyk (>= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16).", "justification": "code_not_present" } }, { "id": "CVE-2020-13934", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.46-tuxcare.14" } ], "bom-ref": "urn:uuid:1bd532d5-a6f9-56bc-abb1-84a8853ba4e2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-13934 does not affect version 9.0.46-tuxcare.14 of org.apache.tomcat:tomcat-coyote. CVE-2020-13934 affects Apache Tomcat 9.0.0.M5-9.0.36", "justification": "code_not_present" } }, { "id": "CVE-2020-13943", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.46-tuxcare.14" } ], "bom-ref": "urn:uuid:4063cc3d-3a77-5d8f-91a9-c06d9913de59", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-13943 does not affect version 9.0.46-tuxcare.14 of org.apache.tomcat:tomcat-coyote. Version 9.0.46 is not vulnerable. Summary: The target repository has the CVE-2020-13943 fix already applied. The max concurrent streams validation check has been correctly moved from headersStart() to headersEnd() method, and the method signature has been updated from ConnectionException to Http2Exception as per the vendor's patch. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "code_not_present" } }, { "id": "CVE-2020-17527", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.46-tuxcare.14" } ], "bom-ref": "urn:uuid:cd89716b-8fd1-5dc1-aed0-56f24255f004", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-17527 does not affect version 9.0.46-tuxcare.14 of org.apache.tomcat:tomcat-coyote. CVE-2020-17527 affects Tomcat 9.0.0-M1 to 9.0.39. The target version 9.0.46 is newer than the affected range and includes all upstream fixes for bug 64830 that address the HTTP/2 header value reuse vulnerability. The fixes eliminate shared mutable state in HPACK decoding (HpackDecoder.java uses local StringBuilder instances), use thread-safe collections (ConnectionSettingsBase.java uses ConcurrentHashMap), and properly handle leftover input during HTTP/2 upgrades (AbstractProtocol.java). All fixes were authored by Apache upstream (markt@apache.org) and shipped in the 9.0.46 release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M10; >= 9.0.0-M1, < 9.0.40; >= 8.5.0, < 8.5.60), NVD (>= 8.5.1, <= 8.5.59; >= 9.0.1, <= 9.0.35; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 9.0.35-3.39.1; = 9.0.35-3.57.3; = 9.0.36; = 9.0.37; = 9.0.38; = 9.0.39; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10.0.0-M1, <= 10.0.0-M9; = 10; >= 9.0.0-M1, <= 9.0.39; = 9; >= 8.5.0, <= 8.5.59; = 8.5), Snyk (<= 0; >= 8.5.0, < 8.5.60; >= 9.0.0, < 9.0.40; >= 10.0.0-M1, < 10.0.0-M10).", "justification": "code_not_present" } }, { "id": "CVE-2021-25122", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.46-tuxcare.14" } ], "bom-ref": "urn:uuid:40f571be-927f-5a28-827e-bc9a73e458cd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-25122 does not affect version 9.0.46-tuxcare.14 of org.apache.tomcat:tomcat-coyote. The target Apache Tomcat 9.0.46 is NOT affected by CVE-2021-25122. All fixes for this h2c request data leakage vulnerability were already present in the upstream Apache Tomcat 9.0.46 release before TuxCare/CloudLinux onboarding. The vulnerability affected versions up to 9.0.41; version 9.0.42 and above contain the complete fix authored by Mark Thomas (markt@apache.org) addressing BZ 64830. The fix includes: (1) proper sequencing of leftover input restoration before processor creation, (2) correct HTTP/1.1 processor release before h2c upgrade, (3) thread-safe HPACK decoder with local StringBuilder instances, and (4) thread-safe ConnectionSettings using ConcurrentHashMap.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.2; >= 9.0.0-M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 10.0.0-M1, < 10.0.2), NVD (>= 8.5.0, <= 8.5.61; >= 9.0.0, <= 9.0.41; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 10.0.0; = 10.0.0-milestone1; = 10.0.0-milestone10; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10, < 10.0.2; >= 9, < 9.0.42; >= 8.5, < 8.5.62), Snyk (>= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; <= 0).", "justification": "code_not_present" } }, { "id": "CVE-2022-42252", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.46-tuxcare.14" } ], "bom-ref": "urn:uuid:a57da0f8-172f-5e79-85b6-73a49303c30d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-42252 is fixed in version 9.0.46-tuxcare.14 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-24998", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.46-tuxcare.14" } ], "bom-ref": "urn:uuid:63959602-b10b-592e-9ff2-59ee5524d882", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-24998 is fixed in version 9.0.46-tuxcare.14 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-28709", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.46-tuxcare.14" } ], "bom-ref": "urn:uuid:684ae8f3-936f-5f46-bc2e-e1cadb8b4b8d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-28709 is fixed in version 9.0.46-tuxcare.14 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-34981", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.46-tuxcare.14" } ], "bom-ref": "urn:uuid:af9b7309-0d9a-59a4-9ced-c6a590b10a8b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-34981 affects version 9.0.46-tuxcare.14 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-42794", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.46-tuxcare.14" } ], "bom-ref": "urn:uuid:2fb7d6d4-6b72-5586-8469-3d5190e70700", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-42794 does not affect version 9.0.46-tuxcare.14 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 Target version 9.0.46 is not affected by CVE-2023-42794. The vulnerability was introduced in Tomcat 9.0.70-9.0.80 during an unreleased refactoring that removed the finalize() method from DiskFileItem.java, causing temporary files to remain on disk when streams were not properly closed. Version 9.0.46 predates this refactoring and retains the original finalize() method (lines 548-559) that provi...", "justification": "code_not_present" } }, { "id": "CVE-2023-44487", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.46-tuxcare.14" } ], "bom-ref": "urn:uuid:193d79ae-26c8-5f61-8817-9d361535661d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-44487 is fixed in version 9.0.46-tuxcare.14 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-45648", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.46-tuxcare.14" } ], "bom-ref": "urn:uuid:b8856124-1e86-534e-9e37-197b6268e0f8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-45648 is fixed in version 9.0.46-tuxcare.14 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-46589", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.46-tuxcare.14" } ], "bom-ref": "urn:uuid:9ccd4573-df04-5d9a-a488-d6cd989389d5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-46589 is fixed in version 9.0.46-tuxcare.14 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-21733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.46-tuxcare.14" } ], "bom-ref": "urn:uuid:ea14c1a2-44dd-509f-84a3-e717f782f8fe", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-21733 does not affect version 9.0.46-tuxcare.14 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 CVE-2024-21733 affects Apache Tomcat 8.5.7-8.5.63 and 9.0.0-M11 through 9.0.43. The target is Tomcat 9.0.46, which already includes the upstream fix (commit d1da266aa1) that was released in version 9.0.44. The fix adds IS_IO_ALLOWED checks in ErrorReportValve to prevent error messages from being written when I/O operations are not permitted, thus preventing information disclosure. This fix was ...", "justification": "code_not_present" } }, { "id": "CVE-2024-24549", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.46-tuxcare.14" } ], "bom-ref": "urn:uuid:ce526f88-6bbb-5ad7-a1fa-c3fad1fcf075", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-24549 is fixed in version 9.0.46-tuxcare.14 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-34750", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.46-tuxcare.14" } ], "bom-ref": "urn:uuid:ae2578a2-8bb1-5c14-8754-1b3665f0b81e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-34750 affects version 9.0.46-tuxcare.14 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-38286", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.46-tuxcare.14" } ], "bom-ref": "urn:uuid:80755edb-2a7a-5c87-9346-9c0352cc92bf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38286 is fixed in version 9.0.46-tuxcare.14 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-52317", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.46-tuxcare.14" } ], "bom-ref": "urn:uuid:af51f8e2-4c23-5b84-a74f-0d20372063c5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-52317 does not affect version 9.0.46-tuxcare.14 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 Target version 9.0.46 is NOT AFFECTED by CVE-2024-52317. The vulnerability concerns incorrect recycling of HTTP/2 request/response objects, but version 9.0.46 does not implement request/response recycling at all. Recycling was introduced in commit 3c5b14b713 (July 2024), which is not present in the 9.0.46 branch. The CVE affects versions 9.0.92-9.0.95 where recycling exists but has a race condi...", "justification": "code_not_present" } }, { "id": "CVE-2025-31650", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.46-tuxcare.14" } ], "bom-ref": "urn:uuid:07d2714a-4da8-5888-a506-9ab672db5265", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-31650 does not affect version 9.0.46-tuxcare.14 of org.apache.tomcat:tomcat-coyote. Version 9.0.46 is not vulnerable. Summary: The target repository is running Apache Tomcat version 9.0.46, which predates the affected version range for CVE-2025-31650. The vulnerability affects versions 9.0.76 through 9.0.102 for Tomcat 9.x, and this version (9.0.46) is not within that range. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "code_not_present" } }, { "id": "CVE-2025-48989", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.46-tuxcare.14" } ], "bom-ref": "urn:uuid:33309162-62a8-5ca3-a186-970236abd2f0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48989 is fixed in version 9.0.46-tuxcare.14 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2025-52434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.46-tuxcare.14" } ], "bom-ref": "urn:uuid:79b3665d-1563-5aec-bae1-efabfc1a6964", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-52434 is fixed in version 9.0.46-tuxcare.14 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2025-53506", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.46-tuxcare.14" } ], "bom-ref": "urn:uuid:3c680492-5bb6-5cb5-ba64-5ba91db33593", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-53506 is fixed in version 9.0.46-tuxcare.14 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2025-66614", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.46-tuxcare.14" } ], "bom-ref": "urn:uuid:50cf9227-eab9-5a3b-bc18-abf61e58fe5d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66614 is fixed in version 9.0.46-tuxcare.14 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-24733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.46-tuxcare.14" } ], "bom-ref": "urn:uuid:9fe682a5-41b8-5a5f-a6ee-4e906dabf9c7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-24733 is fixed in version 9.0.46-tuxcare.14 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-24734", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.46-tuxcare.14" } ], "bom-ref": "urn:uuid:286039d5-7d6e-5343-8b7a-877ddbb511e7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24734 affects version 9.0.46-tuxcare.14 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-24880", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.46-tuxcare.14" } ], "bom-ref": "urn:uuid:ec140b83-df2a-5872-a576-019101b76107", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24880 affects version 9.0.46-tuxcare.14 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-29129", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.46-tuxcare.14" } ], "bom-ref": "urn:uuid:3614c975-fd95-5cf5-9f26-fd605254012c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-29129 does not affect version 9.0.46-tuxcare.14 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 CVE-2026-29129 affects Apache Tomcat 9.0.114-9.0.115 due to a regression introduced when TLS 1.3 cipher suite configuration support was added. The vulnerable code pattern (using unordered HashSet to combine cipher lists, losing configured preference order) does not exist in version 9.0.46. This version predates the feature introduction by approximately 5 years and uses a simpler, correct implem...", "justification": "code_not_present" } }, { "id": "CVE-2026-32990", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.46-tuxcare.14" } ], "bom-ref": "urn:uuid:16280757-4be1-5917-81b2-066219c786b3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-32990 affects version 9.0.46-tuxcare.14 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-41293", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.46-tuxcare.14" } ], "bom-ref": "urn:uuid:66c2abbe-3c61-564b-9fd0-3b17956f9ec1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41293 affects version 9.0.46-tuxcare.14 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-65637", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.46-tuxcare.14" } ], "bom-ref": "urn:uuid:410a2f5e-bc99-50f2-9eb4-80b3f5e536f0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65637 affects version 9.0.46-tuxcare.14 of org.apache.tomcat:tomcat-coyote." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.46-tuxcare.14" } ] }