{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:118635fb-7ddd-5a31-a45d-1c74d0ae0ab7",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "tomcat-tribes",
      "purl": "pkg:maven/org.apache.tomcat/tomcat-tribes@10.1.55-tuxcare.2",
      "type": "library",
      "group": "org.apache.tomcat",
      "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-tribes@10.1.55-tuxcare.2",
      "version": "10.1.55-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "tomcat-tribes",
            "purl": "pkg:maven/org.apache.tomcat/tomcat-tribes@10.1.55",
            "type": "library",
            "group": "org.apache.tomcat",
            "version": "10.1.55"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-29146",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-tribes@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:b26e287b-b4d2-5369-90b6-2d1332d6592d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-29146 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-tribes. Target version 10.1.55 is not affected by CVE-2026-29146. The CVE affects Apache Tomcat versions through 10.1.52, with fixes shipped in 10.1.53+. The target contains upstream fixes (commits 607ebc0fa5 and 55f3eb9148 by markt@apache.org) that mitigate the padding oracle vulnerability through improved error handling and algorithm validation. The error handling ensures all decryption failures are handled uniformly (message dropped, error logged), preventing attackers from distinguishing padding errors from other decryption failures. Algorithm validation warns users that CBC/PKCS5Padding is not recommended and suggests switching to AES/GCM/NoPadding. Both fixes were present in the upstream 10.1.55 release before TuxCare onboarded it.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-34486",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-tribes@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:78c19976-df66-5022-a515-814e4f1b2793",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-34486 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-tribes. Apache Tomcat 10.1.55 is not affected by CVE-2026-34486. The vulnerable code pattern (calling super.messageReceived(msg) after the try-catch block, allowing unencrypted messages to bypass encryption) is not present. The fix commit 55f3eb9148233054fccfdf761141c6894a050be1 by Mark Thomas (markt@apache.org) was already included in the upstream 10.1.55 release that TuxCare onboarded. The current code correctly places super.messageReceived(msg) inside the try block (line 142), ensuring messages are only forwarded to the next interceptor when decryption succeeds.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.20, < 11.0.21; >= 10.1.53, < 10.1.54; >= 9.0.116, < 9.0.117; >= 11.0.20, < 11.0.21; >= 10.1.53, < 10.1.54; >= 9.0.116, < 9.0.117), NVD (= 9.0.116; = 10.1.53; = 11.0.20), cve.org (= 11.0.20; = 10.1.53; = 9.0.116), Snyk (>= 9.0.116, < 9.0.117; >= 10.1.53, < 10.1.54; >= 11.0.20, < 11.0.21).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-34487",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-tribes@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:0d6d6615-6b4b-565c-9746-49b31c2070d5",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-34487 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-tribes. Target Apache Tomcat 10.1.55 is NOT AFFECTED by CVE-2026-34487. The vulnerability (Kubernetes bearer token exposure in log files) has been fixed by upstream Apache in commit 5eff2a773b8b728083e5195b3183df1b9e12a03d, which was already included in the 10.1.55 release that TuxCare onboarded. The CVE affects versions through 10.1.53 and is fixed in 10.1.54; since 10.1.55 > 10.1.54, the fix was already present in the upstream release. All three files show the patched version: AbstractStreamProvider.java removes headers from debug logs, TokenStreamProvider.java removes token from exception messages, and LocalStrings.properties updates message templates accordingly.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.13, < 9.0.117; >= 10.1.0-M1, < 10.1.54; >= 11.0.0-M1, < 11.0.21; >= 9.0.13, < 9.0.117; >= 10.1.0-M1, < 10.1.54; >= 11.0.0-M1, < 11.0.21; >= 9.0.13, < 9.0.117; >= 10.1.0-M1, < 10.1.54; >= 11.0.0-M1, < 11.0.21), NVD (>= 9.0.13, < 9.0.117; >= 10.1.0, < 10.1.54; >= 11.0.0, < 11.0.21), cve.org (>= 11.0.0-M1, <= 11.0.20; >= 10.1.0-M1, <= 10.1.53; >= 9.0.13, <= 9.0.116), Snyk (>= 9.0.13, < 9.0.117; >= 10.1.0-M1, < 10.1.54; >= 11.0.0-M1, < 11.0.21).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-55955",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-tribes@10.1.55-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:b1735739-bde9-5c2d-8792-a75b51f1f860",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-55955 affects version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-tribes."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.tomcat/tomcat-tribes@10.1.55-tuxcare.2"
    }
  ]
}