{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:a982a62e-c73c-5505-aa51-3a6ce51e6e07", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat", "purl": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.7", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.7", "version": "7.0.109-tuxcare.7", "pedigree": { "ancestors": [ { "name": "tomcat", "purl": "pkg:maven/org.apache.tomcat/tomcat@7.0.109", "type": "library", "group": "org.apache.tomcat", "version": "7.0.109" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2008-1947", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:07009615-bee7-55f5-a685-fb8e4a585c97", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2008-1947 does not affect version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2008-1947 is not present in Apache Tomcat 7.0.109. The vulnerability was an XSS issue in the host-manager HTML interface where the hostname parameter was not properly HTML-escaped when rendered in responses. The fix was already included in the upstream Apache Tomcat 7.0.109 release that TuxCare onboarded. The fix adds HTML escaping via RequestUtil.filter() for all hostname outputs in the HT...", "justification": "code_not_present" } }, { "id": "CVE-2013-4590", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:7a4cd0e9-1888-5fb6-a886-d43114e7cb8a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-4590 does not affect version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat. Tomcat 7.0.109 is not vulnerable as it is outside the affected ranges: [0, 6.0.37]", "justification": "code_not_present" } }, { "id": "CVE-2015-5174", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:b91e847a-297e-5531-a47f-8c4b7eb75961", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2015-5174 does not affect version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2015-5174 is not present in Tomcat 7.0.109-tuxcare.4. The upstream Apache fix (commit 90ca468fc6, April 2016) was already included in the official Tomcat 7.0.109 release (April 2021) before TuxCare adopted the repository. The fix uses an alternative approach (addedTrailingSlash logic) compared to the trunk patch (78688b0a30), but achieves the same security goal by preventing directory trave...", "justification": "code_not_present" } }, { "id": "CVE-2015-5346", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:670ce51d-fcff-5661-83a8-84128db321a1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5346 affects version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2016-0706", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:49268a59-53ea-5c0e-a6a5-bbeee69b1a06", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-0706 does not affect version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat. Tomcat 7.0.109 is not vulnerable as it is outside the affected ranges: [6.0.0, 6.0.45), [8.0.0.RC1, 8.0.31), [9.0.0.M1, 9.0.0.M2)", "justification": "code_not_present" } }, { "id": "CVE-2016-0762", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:46618998-5d5b-5104-9e41-3309f6963f19", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-0762 does not affect version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2016-0762 describes a timing attack vulnerability in Apache Tomcat Realm implementations (versions 7.0.0-7.0.70) where passwords were not processed when usernames didn't exist, allowing attackers to enumerate valid usernames through timing analysis. The target version (7.0.109-tuxcare.4) already contains the upstream Apache fix from August 2016 (commit 970e615c7a by Mark Thomas, first relea...", "justification": "code_not_present" } }, { "id": "CVE-2016-0763", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:b510753b-ef6a-5d0c-962c-16c37df6e80d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-0763 does not affect version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat. CVE-2016-0763 affects Apache Tomcat 7.0.0-7.0.67", "justification": "code_not_present" } }, { "id": "CVE-2016-6794", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:d2fd8955-8ae2-5fad-ab4f-27b623057dbc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-6794 does not affect version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat. CVE-2016-6794 affects Apache Tomcat 7.0.0-7.0.70", "justification": "code_not_present" } }, { "id": "CVE-2016-6796", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:bce33e78-1eb9-5d58-be72-437fbf65fe3d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-6796 affects version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2016-6797", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:b4441d2a-2c9a-5e97-84d7-21e67a6009c0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-6797 does not affect version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat. CVE-2016-6797 does not affect Tomcat 7.0.109-tuxcare.4. The vulnerability, which allowed web applications to access any global JNDI resource without explicit ResourceLink configuration, was fixed by upstream Apache in version 7.0.71 (released August 2016). The CVE affects versions 7.0.0 to 7.0.70. The target version (7.0.109) inherited the fix from the upstream Apache Tomcat distribution. The fix is present and fully functional in the target code.", "justification": "code_not_present" } }, { "id": "CVE-2016-6817", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:6dd86104-1e82-5e0d-a08e-50fe50a0ef5d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-6817 does not affect version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat. Version 7.0.109 is not vulnerable. Summary: Target repository is Tomcat 7.0.109-tuxcare.1, which does not have HTTP/2 support. CVE-2016-6817 affects the HTTP/2 header parser in Tomcat 9.0.0.M1 to 9.0.0.M11 and 8.5.0 to 8.5.6. Since HTTP/2 support was first introduced in Tomcat 8.5 and 9.0, and the target is running Tomcat 7.0.x, the vulnerable component (java/org/apache/coyote/http2/Http2Parser.java) does not exist in this codebase. Therefore, the vulnerability cannot exist.", "justification": "code_not_present" } }, { "id": "CVE-2016-8747", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:a0067bf9-5d9b-5e61-b7ab-2963ca16863f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-8747 does not affect version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat. Version 7.0.109 is not vulnerable. Summary: CVE-2016-8747 does not affect the target repository. The target is Tomcat 7.0.109, which uses a fundamentally different architecture (byte arrays with System.arraycopy) that predates the vulnerable ByteBuffer refactoring introduced in Tomcat 8.5.7. The vulnerable class Http11InputBuffer.java does not exist in Tomcat 7.x.", "justification": "code_not_present" } }, { "id": "CVE-2017-5647", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:e9c1f8ed-abac-50e4-9a63-a4a6fcba9999", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-5647 does not affect version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat. CVE-2017-5647 affects Apache Tomcat 7.0.0-7.0.76", "justification": "code_not_present" } }, { "id": "CVE-2017-5650", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:d44769d7-180e-5741-8399-b743ef4adf18", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-5650 does not affect version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat. Version 7.0.109 is not vulnerable. Summary: Target repository (Apache Tomcat 7.0.109) does not contain HTTP/2 implementation. CVE-2017-5650 affects HTTP/2 GOAWAY frame handling in Tomcat 8.5.0-8.5.12 and 9.0.0.M1-9.0.0.M18. HTTP/2 support was first introduced in Tomcat 8.5.0, so Tomcat 7.x completely predates the vulnerable feature.", "justification": "code_not_present" } }, { "id": "CVE-2017-5664", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:e0659915-2236-5644-8e5b-413f684f179a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-5664 does not affect version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat. CVE-2017-5664 is NOT present in Tomcat 7.0.109-tuxcare.4. The vulnerability was fixed by upstream Apache in commit 58b32048 (May 2017) before the 7.0.109 release. TuxCare inherited this fix when onboarding version 7.0.109. Both DefaultServlet and WebdavServlet now properly force error dispatches through doGet() regardless of the original HTTP method, preventing modification/deletion of static error pages via PUT/DELETE requests.", "justification": "code_not_present" } }, { "id": "CVE-2017-7674", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:1f2ae41a-4ac7-55a9-938c-191054097701", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2017-7674 is fixed in version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2017-7675", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:577f8dbf-6517-5cd1-8c1e-4c4c1071c1f0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-7675 does not affect version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat. Version 7.0.109 is not vulnerable. Summary: Target repository is Tomcat 7.0.109, which does not contain HTTP/2 support. The vulnerability CVE-2017-7675 is specific to the HTTP/2 implementation that was introduced in Tomcat 8.5.0 and 9.0.0.M1. Since the vulnerable feature (HTTP/2) was never introduced in Tomcat 7.x, the target is not vulnerable.", "justification": "code_not_present" } }, { "id": "CVE-2019-0221", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:7133d1b4-a32f-5a23-a909-000da90a1bc4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-0221 does not affect version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2019-0221 is NOT present in Tomcat 7.0.109. The vulnerability affected SSI printenv command's lack of HTML entity encoding (versions 7.0.0-7.0.93). The target already contains the upstream fix (commit 44ec74c44d by Mark Thomas, 2019-03-11) which adds entity encoding via SSIMediator.ENCODING_ENTITY. This fix was shipped in the upstream Apache Tomcat 7.0.109 release that TuxCare onboarded on ...", "justification": "code_not_present" } }, { "id": "CVE-2019-17569", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:0e82d9b8-0596-556b-8c48-9437d3f8d9ab", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-17569 does not affect version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat. not_affected \u2014 Target version 7.0.109 is not affected by CVE-2019-17569. The vulnerability was a regression introduced in Tomcat 7.0.98-7.0.99 where invalid Transfer-Encoding headers were incorrectly ignored instead of being rejected, enabling HTTP Request Smuggling. The upstream fix (commit b191a0d9cf) was already included in the Tomcat 7.0.109 release that TuxCare onboarded. The current code properly valida...", "justification": "code_not_present" } }, { "id": "CVE-2020-11996", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:2342541c-40eb-5cd0-8abd-cdef464bf210", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-11996 affects version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2020-13934", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:2bf85fdd-f113-5ce6-95f4-bb9250e7306c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-13934 does not affect version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat. CVE-2020-13934 affects Apache Tomcat 8.5.1-8.5.56 and 9.0.0.M5-9.0.36 only; 7.0.x is not affected", "justification": "code_not_present" } }, { "id": "CVE-2020-13935", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:c86ff9e6-051c-5504-a234-cc9cf61d7f16", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-13935 does not affect version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat. CVE-2020-13935 is NOT present in Tomcat 7.0.109. The vulnerability (infinite loop triggered by WebSocket frames with invalid 64-bit payload length where MSB is set) was fixed in upstream Apache Tomcat commit f9f75c1467 by Mark Thomas, which shipped in the 7.0.109 release before TuxCare onboarded it. The fix adds validation at WsFrameBase.java:262-265 that rejects negative payload lengths (MSB set), preventing the infinite loop. CVE affected versions: 7.0.27 to 7.0.104; target version 7.0.109 is beyond the affected range.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M1, < 9.0.37; >= 8.5.0, < 8.5.57; >= 7.0.27, < 7.0.105; >= 7.0.27, < 7.0.105; >= 8.5.0, < 8.5.57; >= 9.0.0.M1, < 9.0.37; >= 10.0.0-M1, < 10.0.0-M7), NVD (>= 7.0.27, <= 7.0.104; >= 8.5.0, <= 8.5.56; >= 9.0.1, <= 9.0.36; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6), cve.org (>= 10.0.0-M1, <= 10.0.0-M6; >= 9.0.0.M1, <= 9.0.36; >= 8.5.0, <= 8.5.56; >= 7.0.27, <= 7.0.104), Snyk (<= 0).", "justification": "code_not_present" } }, { "id": "CVE-2020-1935", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:70e20a8f-a0d4-5f1c-b383-0394fdc911e5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-1935 does not affect version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2020-1935 fix is present in target Tomcat 7.0.109. The vulnerability allowed HTTP request smuggling via invalid control characters in header values. The upstream fix (commit 702bf15bea, 2020-01-06) added strict validation: (1) rejects standalone CR not followed by LF, (2) rejects control characters (0x00-0x1F except TAB, 0x7F) in header values via HttpParser.isControl(), (3) removes invalid...", "justification": "code_not_present" } }, { "id": "CVE-2020-8022", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:7a67a0d4-2910-5de3-acf1-865d5d70080d", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2020-8022 is a false positive for org.apache.tomcat:tomcat 7.0.109-tuxcare.7." } }, { "id": "CVE-2021-30639", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:a2b996a0-ef11-5c83-b50b-2cbd65c0fbaf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-30639 affects version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2021-30640", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:5e40921e-041f-57f7-9122-88bbd4423947", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-30640 does not affect version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2021-30640 affects Tomcat's JNDI Realm authentication by allowing attackers to authenticate using username variations containing special LDAP characters (`;`, `*`, `+`, `,`, etc.) due to missing escaping. The vulnerability is NOT present in the target (Tomcat 7.0.109). The upstream fix (commit e21eb4764c by Mark Thomas, April 13, 2021) adds proper RFC 4514 attribute value escaping and RFC 2...", "justification": "code_not_present" } }, { "id": "CVE-2021-33037", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:1f118dd8-bd8d-5460-8b38-02e6003ba7ea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-33037 is fixed in version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2021-41079", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:31ed00e2-9a87-58ee-a244-ef10f00f4e30", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-41079 does not affect version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat. Prechecker: No vulnerable code from the fix was found; the classes the fix changes and their component are absent from this version. Version 7.0.109 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-59g9-7gfx-c72p (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (newer lines only).", "justification": "code_not_present" } }, { "id": "CVE-2021-42340", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:47ffbfd0-2387-502b-9b47-0bb5b58a109c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-42340 is fixed in version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2021-43980", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:03a62a4d-9b2b-524e-8a26-a0eff50f98fb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-43980 does not affect version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat. not_affected \u2014 Tomcat 7.0.109 is not affected by CVE-2021-43980. The vulnerability is specific to an architectural change introduced in Tomcat 10 and back-ported to Tomcat 9.0.47+, where processor-to-socket mapping was moved from a thread-safe ConcurrentHashMap to a non-atomic currentProcessor field in SocketWrapperBase. Tomcat 7.0.109 still uses the older, thread-safe ConcurrentHashMap architecture and does ...", "justification": "code_not_reachable" } }, { "id": "CVE-2022-23181", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:e2c106bf-551a-553c-a64c-616d91498812", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-23181 is fixed in version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2022-25762", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:ef93506f-440e-53f8-a4a3-935bfd547bfa", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-25762 does not affect version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because existing runtime guards prevent a WebSocket send racing with closure from returning the same object to a pool twice. Cache returns require a non-null cancelled attachment at java/org/apache/tomcat/util/net/NioEndpoint.java:1834; cancellation detaches it with key.attach(null) at java/org/apache/tomcat/util/net/NioEndpoint.java:1126, so repeated closure cannot return it again.", "justification": "code_not_present" } }, { "id": "CVE-2022-29885", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:960d7b8f-8dcb-5ea8-a3ce-a09870b740c3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-29885 affects version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2022-34305", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:4452f551-c594-5bc5-8f22-6baa518ec732", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-34305 is fixed in version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2023-41080", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:df85ea17-1603-5898-b09b-a8bb19efc458", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-41080 is fixed in version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2023-42795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:9c58483c-85ae-5515-9aae-14e038bf711b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-42795 affects version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2023-45648", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:b767075f-ef41-595e-bb04-5bca91bd0532", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-45648 affects version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2024-54677", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:cb3e4433-1d23-5295-b183-0290c6ee3382", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-54677 affects version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2025-49124", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:d748cba5-bcc4-5289-b2f1-04083c633bea", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49124 affects version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2025-55752", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:b1cd7800-e160-5235-ab56-b7d4da56cfa9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55752 affects version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2025-55754", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:d5414c3b-fbea-5f93-a3a4-a26e107730e7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55754 affects version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2025-61795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:eb23cd24-dc99-56d0-bcf8-869dca1bece0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-61795 is fixed in version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2025-66614", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:5e61682c-7a97-5763-8009-39178b39d69b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66614 affects version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-25854", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:c2e8f094-871d-5937-b038-f64d6836effa", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-25854 does not affect version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat. not_affected \u2014 Target Apache Tomcat 7.0.109 is not affected by CVE-2026-25854. The vulnerable component LoadBalancerDrainingValve does not exist in this version. The valve was introduced in Tomcat 8.5.30 (backport on 2018-03-29), 9.0.0-M23 (original on 2017-06-21), and later versions. Version 7.0.109 predates the introduction of this component entirely.", "justification": "code_not_present" } }, { "id": "CVE-2026-29129", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:26f4a1cd-d9ac-56f5-b087-ed0217a1800f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-29129 does not affect version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat. not_affected \u2014 Apache Tomcat 7.0.109 is NOT AFFECTED by CVE-2026-29129. The vulnerability exists in SSLHostConfig.java's getJsseCipherNames() method which uses HashSet (losing cipher order). Version 7.0.109 does not have SSLHostConfig.java - it uses an older architecture (JSSESocketFactory) that processes ciphers with ArrayList, which preserves the configured order. The vulnerable code pattern was introduced ...", "justification": "code_not_present" } }, { "id": "CVE-2026-29145", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:4f4b9abb-2fc2-5c19-819d-17eaf395fd7d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-29145 does not affect version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat. The official CVE record (https://www.cve.org/CVERecord?id=CVE-2026-29145) limits the affected versions to Apache Tomcat 9.0.13\u20139.0.115, 10.1.0-M7\u201310.1.52, and 11.0.0-M1\u201311.0.18. Version 7.0.109 is not within any of these ranges", "justification": "code_not_present" } }, { "id": "CVE-2026-29146", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:6f22ed61-881f-5cae-8a1a-5ac49af1339f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29146 is fixed in version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-32990", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:246985d3-227d-5d77-ba53-8a6fb4d299d7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-32990 affects version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-34483", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:21cddb1f-e5d6-59a0-86bf-96552473e9c1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34483 affects version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-34486", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:d8bf824a-625a-5ba1-905f-e526b2a852f3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34486 is fixed in version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-34487", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:7b1e8599-69da-53f3-a650-f41df2ac9ab4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-34487 does not affect version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat. Prechecker: No vulnerable code from the fix was found; the classes the fix changes and their component are absent from this version. Version 7.0.109 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-x4m4-345f-5h5g (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (newer lines only).", "justification": "code_not_present" } }, { "id": "CVE-2026-41284", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:fb23f29a-5fda-5f69-9b04-49bc7fc9eb59", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41284 affects version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-41293", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:97ad6af0-2666-5409-8ec7-8e1d5b417ea3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41293 affects version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-42498", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:b03acf3d-3fab-5b96-ab24-5e84d0e7b79e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42498 affects version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-43512", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:f1c90124-1dbd-5399-b215-fefe5ccc5465", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43512 affects version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-43513", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:03acf4a3-d257-5b8d-b9d3-969d730933d8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43513 affects version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-43514", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:3691e657-0aff-5a06-ab06-c7b207726c72", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43514 affects version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-43515", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:1949064c-8c10-5118-b48a-cc9e920babd3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43515 affects version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-50229", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:468c4032-63dd-57e7-9fb5-b9863ed28d0f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50229 affects version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-53404", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:255b5ee3-a574-5ae8-bcd6-cae579da7c5e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53404 affects version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-55276", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:440ff875-3ad5-5567-9ed3-bb83d6d38a25", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-55276 affects version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-55955", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:89b64aa4-825a-5cbe-94df-439ae468c314", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-55955 affects version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-55956", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:ef5d9b1b-865b-5cab-9c94-f3c530b8c7f3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-55956 affects version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-55957", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:1d998a74-268d-5b94-9c3a-3b4eeb6f487a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-55957 affects version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-65182", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:fe36e25a-330c-5987-8495-f9431bd3a3db", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65182 affects version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-65905", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:6406e129-8440-50ce-bc80-a89dae52b31e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65905 affects version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-68525", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:cef74f14-add8-53c2-8797-5d35bfbd9fe3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-68525 affects version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@7.0.109-tuxcare.7" } ] }