{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:196dde2c-fe04-574b-b663-08691680a2bc",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "tomcat-util",
      "purl": "pkg:maven/org.apache.tomcat/tomcat-util@10.1.50-tuxcare.2",
      "type": "library",
      "group": "org.apache.tomcat",
      "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-util@10.1.50-tuxcare.2",
      "version": "10.1.50-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "tomcat-util",
            "purl": "pkg:maven/org.apache.tomcat/tomcat-util@10.1.50",
            "type": "library",
            "group": "org.apache.tomcat",
            "version": "10.1.50"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2016-8745",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-util@10.1.50-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:de9b3fe4-e6d5-5c7d-bb7d-0695c470bdc1",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-8745 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-util. CVE-2016-8745 affects the NIO HTTP connector's sendfile error handling, where the Processor could be added to the cache multiple times, enabling information leakage between concurrent requests. The target (Tomcat 10.1.50) is NOT AFFECTED because the upstream vendor (Apache Tomcat) fixed this vulnerability in commit cbc9b18a84 (November 2016), which is present in the 10.1.50 release. The fix ensures that socket cleanup during sendfile errors only occurs when NOT called by the processor itself (via `if (!calledByProcessor && sc != null)`), preventing double-addition to the processor cache. This is an upstream fix that shipped with the base 10.1.50 release before TuxCare's onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M14; >= 8.5.0, < 8.5.9; >= 8.0.0-RC1, < 8.0.41; >= 7.0.0, < 7.0.75; >= 6.0.16, < 6.0.50), NVD (= 7.0.0; = 7.0.1; = 7.0.2; = 7.0.3; = 7.0.4; = 7.0.5; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.52; = 7.0.53; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 8.0; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc3; = 8.0.0-rc5; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.8; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M13; >= 8.5.0, <= 8.5.8; >= 8.0.0.RC1, <= 8.0.39; >= 7.0.0, <= 7.0.73; >= 6.0.16, <= 6.0.48), Snyk (<= 0; >= 7, < 7.0.74; >= 8.5.0, < 8.5.9; >= 8.0.0RC1, < 8.0.40; >= 9.0.0M1, < 9.0.0M15; >= 7, < 7.0.74; >= 8.5.0, < 8.5.9; >= 8.0.0RC1, < 8.0.40; >= 9.0.0M1, < 9.0.0M15; >= 7, < 7.0.74; >= 8.5.0, < 8.5.9; >= 8.0.0RC1, < 8.0.40; >= 9.0.0M1, < 9.0.0M15).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-45143",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-util@10.1.50-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:993b31a8-340b-5aa1-8aff-c8e856bbf8cd",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-45143 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-util. CVE-2022-45143: The target is NOT affected. The vulnerability (missing JSON escaping in JsonErrorReportValve for type/message/description fields) was fixed by upstream Apache Tomcat in commit 1f50bff8daabb48c5f15398689988f26aac6ec56 (author: Mark Thomas, markt@apache.org, Nov 9 2022). This fix was already included in the upstream Tomcat 10.1.50 release when TuxCare onboarded it via commit 8f04542b9a2881ccb651bfb2518a0f2745687b8c. The current HEAD contains JSONFilter.escape() protecting all three vulnerable fields, eliminating the JSON injection vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0, < 10.1.2; >= 10.1.0, < 10.1.2; >= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69), NVD (>= 9.0.40, < 9.0.69; = 8.5.83; = 10.1.0-milestone1; = 10.1.0-milestone10; = 10.1.0-milestone11; = 10.1.0-milestone12; = 10.1.0-milestone13; = 10.1.0-milestone14; = 10.1.0-milestone15; = 10.1.0-milestone16; = 10.1.0-milestone17; = 10.1.0-milestone2; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8; = 10.1.0-milestone9; = 10.1.1), cve.org (>= 10.1.0-M1, <= 10.1.1; >= 9.0.40, <= 9.0.68; = 8.5.83), Snyk (>= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0-M1, < 10.1.2; >= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0-M1, < 10.1.2; >= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0-M1, < 10.1.2).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-42795",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-util@10.1.50-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:d6c18b2b-6b0d-5d0e-954c-7d27117a14b1",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-42795 does not affect version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-util. not_affected \u2014 CVE-2023-42795 is NOT present in Tomcat 10.1.50. The upstream fix (commit 9375d67106f by Mark Thomas on 2023-10-05) was already included in the upstream release before TuxCare onboarded version 10.1.50. All four affected recycle() methods (Request.java, ApplicationHttpRequest.java, B2CConverter.java, C2BConverter.java) contain the protective try-catch blocks that prevent exceptions from abortin...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-53434",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-util@10.1.50-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:4d754397-60ac-52a0-8a4f-6bb60bd6ffeb",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-53434 affects version 10.1.50-tuxcare.2 of org.apache.tomcat:tomcat-util, and is fixed in 10.1.50-tuxcare.3."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.tomcat/tomcat-util@10.1.50-tuxcare.2"
    }
  ]
}