{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:0960b47f-ddfd-55a6-a1a6-fa0864a2d62f",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "tomcat-util",
      "purl": "pkg:maven/org.apache.tomcat/tomcat-util@9.0.46-tuxcare.11",
      "type": "library",
      "group": "org.apache.tomcat",
      "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-util@9.0.46-tuxcare.11",
      "version": "9.0.46-tuxcare.11",
      "pedigree": {
        "ancestors": [
          {
            "name": "tomcat-util",
            "purl": "pkg:maven/org.apache.tomcat/tomcat-util@9.0.46",
            "type": "library",
            "group": "org.apache.tomcat",
            "version": "9.0.46"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2016-8745",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-util@9.0.46-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:37ffd275-280e-5109-bd40-0a2fd4d60abe",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-8745 does not affect version 9.0.46-tuxcare.11 of org.apache.tomcat:tomcat-util. The target Tomcat 9.0.46 is not affected by CVE-2016-8745. The vulnerability (Processor object added to cache multiple times due to incorrect error handling in NIO sendfile operations) was fixed in upstream commit cbc9b18a84 (2016-11-29) by Apache committer Violeta Georgieva, well before the Tomcat 9.0.46 release (2021-05-08). The fix removed unconditional cancelledKey() calls from sendfile error paths, making them conditional on !calledByProcessor. Analysis of the current NioEndpoint.java at lines 1003-1017 confirms the fix is present in the shipped version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M14; >= 8.5.0, < 8.5.9; >= 8.0.0-RC1, < 8.0.41; >= 7.0.0, < 7.0.75; >= 6.0.16, < 6.0.50), NVD (= 7.0.0; = 7.0.1; = 7.0.2; = 7.0.3; = 7.0.4; = 7.0.5; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.52; = 7.0.53; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 8.0; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc3; = 8.0.0-rc5; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.8; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M13; >= 8.5.0, <= 8.5.8; >= 8.0.0.RC1, <= 8.0.39; >= 7.0.0, <= 7.0.73; >= 6.0.16, <= 6.0.48), Snyk (<= 0; >= 7, < 7.0.74; >= 8.5.0, < 8.5.9; >= 8.0.0RC1, < 8.0.40; >= 9.0.0M1, < 9.0.0M15; >= 7, < 7.0.74; >= 8.5.0, < 8.5.9; >= 8.0.0RC1, < 8.0.40; >= 9.0.0M1, < 9.0.0M15; >= 7, < 7.0.74; >= 8.5.0, < 8.5.9; >= 8.0.0RC1, < 8.0.40; >= 9.0.0M1, < 9.0.0M15).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-45143",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-util@9.0.46-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:98c4cb63-8acf-50a1-aeb8-a6c8e3d8d509",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-45143 is fixed in version 9.0.46-tuxcare.11 of org.apache.tomcat:tomcat-util."
      }
    },
    {
      "id": "CVE-2023-42795",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-util@9.0.46-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:eeb551cb-21be-5f0f-9f6d-e46f1c0c7398",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2023-42795 is fixed in version 9.0.46-tuxcare.11 of org.apache.tomcat:tomcat-util."
      }
    },
    {
      "id": "CVE-2026-53434",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-util@9.0.46-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:088cc854-04ca-5212-966b-21d32389f9ba",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-53434 affects version 9.0.46-tuxcare.11 of org.apache.tomcat:tomcat-util."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.tomcat/tomcat-util@9.0.46-tuxcare.11"
    }
  ]
}