{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:0c9b55da-c9c8-5c95-9867-221191eae812", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat", "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.3", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.3", "version": "8.5.78-tuxcare.3", "pedigree": { "ancestors": [ { "name": "tomcat", "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.78", "type": "library", "group": "org.apache.tomcat", "version": "8.5.78" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2008-1947", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.3" } ], "bom-ref": "urn:uuid:64c1951a-4a0e-50df-baff-fb1543bc5f20", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2008-1947 does not affect version 8.5.78-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 Apache Tomcat 8.5.78 is not affected by CVE-2008-1947. The XSS vulnerability in the host-manager application was fixed by upstream Apache in June 2008 (commit 78ad0fcbe2) by Mark Thomas. The fix added HTML escaping via RequestUtil.filter() (later refactored to Escape.htmlElementContent()) and URL encoding for the hostname parameter. This fix was already present in the upstream Apache Tomcat 8.5...", "justification": "code_not_present" } }, { "id": "CVE-2013-4590", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.3" } ], "bom-ref": "urn:uuid:8f2fea56-0d84-5b1c-89e5-568896eef7ac", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-4590 does not affect version 8.5.78-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2013-4590 (XXE vulnerability) is NOT present in Apache Tomcat 8.5.78-tuxcare.3. The fix was already included in the upstream Apache Tomcat 8.5.78 release. The target has xmlBlockExternal=true by default in StandardContext, and LocalResolver implements comprehensive blocking of external entities that are not in the whitelist of known-safe resources. The fix commit (78dd7e6f3d) was authored b...", "justification": "code_not_present" } }, { "id": "CVE-2015-5174", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.3" } ], "bom-ref": "urn:uuid:3614d151-e3cb-5981-b101-736a3ccc1d33", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2015-5174 does not affect version 8.5.78-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2015-5174 directory traversal vulnerability is NOT present in Apache Tomcat 8.5.78. The fix (commits 78688b0a30 and 97d2cf36c4 by Mark Thomas) was already included in the upstream Apache Tomcat 8.5.78 release that TuxCare onboarded. The current implementation uses a refactored approach (trailing slash normalization from commit 90ca468fc6, 2016-04-20) that correctly prevents directory traver...", "justification": "code_not_present" } }, { "id": "CVE-2015-5346", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.3" } ], "bom-ref": "urn:uuid:e5d9b1fe-d714-5fc1-a218-52b54ff00cd8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2015-5346 does not affect version 8.5.78-tuxcare.3 of org.apache.tomcat:tomcat. Prechecker: No vulnerable code from the fix was found, and every line the fix adds is already in this version. No affected range in the advisories covers version 8.5.78. Advisories: GitHub GHSA-jrcp-c39h-r29x (no listed range covers this version), NVD (no listed range covers this version).", "justification": "code_not_present" } }, { "id": "CVE-2016-0706", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.3" } ], "bom-ref": "urn:uuid:9286341e-a66d-55f1-a44a-1798ffc8003e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-0706 does not affect version 8.5.78-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2016-0706 is NOT present in target Tomcat 8.5.78-tuxcare.3. The vulnerability required StatusManagerServlet to be absent from the RestrictedServlets.properties list, allowing non-privileged web applications to load it and read arbitrary HTTP requests/session data. The upstream fix (commit b3e1bad0bf by markt@apache.org, Jan 4 2016) added StatusManagerServlet to the restricted list, and this...", "justification": "code_not_present" } }, { "id": "CVE-2016-0762", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.3" } ], "bom-ref": "urn:uuid:1dd750c9-de0c-54a1-86f8-d6ae8d094963", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-0762 does not affect version 8.5.78-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2016-0762 timing attack vulnerability is NOT present in Tomcat 8.5.78. The upstream Apache fix (commit d79c63d424) was included in version 8.5.5 (released 2016-08-31), well before version 8.5.78 was released. All four critical Realm implementations (RealmBase, DataSourceRealm, JDBCRealm, MemoryRealm) contain the timing attack mitigation code that calls getCredentialHandler().mutate(credenti...", "justification": "code_not_present" } }, { "id": "CVE-2016-0763", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.3" } ], "bom-ref": "urn:uuid:1a5bcd3c-4953-5794-8ac5-bcbbfd9e1a03", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-0763 does not affect version 8.5.78-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2016-0763 is NOT present in Tomcat 8.5.78. The vulnerability affects the setGlobalContext method in ResourceLinkFactory.java, which in vulnerable versions lacks authorization checks, allowing untrusted web applications to replace the global JNDI context and access arbitrary application data or cause DoS. The fix (commit bc8717f41a by upstream Apache developer kkolinko@apache.org) adds a Sec...", "justification": "code_not_present" } }, { "id": "CVE-2016-6794", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.3" } ], "bom-ref": "urn:uuid:45ccba39-75f1-5483-981d-3dd01c2c8030", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-6794 does not affect version 8.5.78-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 Apache Tomcat 8.5.78 is not affected by CVE-2016-6794. The vulnerability allows malicious web applications to bypass SecurityManager and read system properties via the configuration file property replacement feature. The fix (PermissionCheck mechanism) was already present in the upstream Apache Tomcat 8.5.78 release that TuxCare onboarded, applied by upstream author Mark Thomas in commit f8db07...", "justification": "code_not_present" } }, { "id": "CVE-2016-6796", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.3" } ], "bom-ref": "urn:uuid:16ca1435-00e6-53de-9764-c06c9ca01423", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-6796 does not affect version 8.5.78-tuxcare.3 of org.apache.tomcat:tomcat. The target Tomcat 8.5.78 is NOT vulnerable to CVE-2016-6796. The vulnerability allowed malicious web applications to bypass SecurityManager restrictions by manipulating JSP servlet init-parameters `engineOptionsClass` and `scratchdir`. The fix, which adds SecurityManager checks to nullify these dangerous parameters when SecurityManager is enabled, is already present in the target code. This fix was authored by upstream maintainer Mark Thomas (markt@apache.org) in commit f97769f50e on August 30, 2016, and was included in the upstream 8.5.78 release that TuxCare onboarded. The vulnerable code pattern does not exist in this version.", "justification": "code_not_present" } }, { "id": "CVE-2016-6797", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.3" } ], "bom-ref": "urn:uuid:429b9002-ba9f-50a1-8440-a90d30cfece8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-6797 does not affect version 8.5.78-tuxcare.3 of org.apache.tomcat:tomcat. CVE-2016-6797 is NOT present in Apache Tomcat 8.5.78. The vulnerability allowed web applications to access any global JNDI resource without explicit ResourceLink configuration. The upstream fix (commit d6b5600afe by Mark Thomas, August 22, 2016) added an access control mechanism that validates ClassLoader authorization before allowing global resource access. This fix was already present in the upstream Tomcat 8.5.78 release that TuxCare onboarded, making the target not affected by this vulnerability.", "justification": "code_not_present" } }, { "id": "CVE-2016-6817", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.3" } ], "bom-ref": "urn:uuid:653142ef-8e11-56ac-9adb-849fdfcbef0f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-6817 does not affect version 8.5.78-tuxcare.3 of org.apache.tomcat:tomcat. CVE-2016-6817 (HTTP/2 header parser infinite loop) is NOT present in Apache Tomcat 8.5.78. The target version includes the upstream fix from commit 85c63227ed, authored by Mark Thomas (markt@apache.org), which shipped in Tomcat 8.5.7. The fix dynamically expands the header read buffer when capacity is exhausted, preventing the infinite loop that occurred when headers exceeded the fixed 1024-byte buffer. The vulnerable pattern (fixed-size buffer causing infinite loop when remaining() == 0 and payloadSize > 0) does not exist in the target code.", "justification": "code_not_present" } }, { "id": "CVE-2016-8747", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.3" } ], "bom-ref": "urn:uuid:573d9474-265b-5952-a143-fdb41422ac16", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-8747 does not affect version 8.5.78-tuxcare.3 of org.apache.tomcat:tomcat. Apache Tomcat 8.5.78 is NOT vulnerable to CVE-2016-8747. The vulnerability affected versions 8.5.7-8.5.9 (and 9.0.0.M11-M15) due to incorrect ByteBuffer state management in Http11InputBuffer.nextRequest() that could allow cross-request information disclosure on persistent HTTP connections. The fix (commit 9601a937ff by Mark Thomas, December 2016) was applied upstream in Tomcat 8.5.10 and is present in the target's 8.5.78 release. The vulnerable pattern is not present; the code correctly calls byteBuffer.flip() after compact() and properly resets buffer state between requests.", "justification": "code_not_present" } }, { "id": "CVE-2017-5647", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.3" } ], "bom-ref": "urn:uuid:4809a721-776b-5aee-a163-7b287bde315c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-5647 does not affect version 8.5.78-tuxcare.3 of org.apache.tomcat:tomcat. CVE-2017-5647 is NOT present in Tomcat 8.5.78. The vulnerability (pipelined requests being lost during sendfile processing, causing response-to-request mismatches) was fixed in upstream Tomcat 8.5.13 (March 2017) by commit f5e06b8c74. The fix introduced the SendfileKeepAliveState enum with three states (NONE, PIPELINED, OPEN) to properly handle pipelined requests when sendfile completes. Version 8.5.78 shipped with this fix already in place. The fix was authored by Apache upstream (markt@apache.org), not TuxCare. All key fix components are verified present: the new enum, the input buffer check in Http11Processor.processSendfile(), and the three-state switch logic in all endpoint implementations (AprEndpoint, Nio2Endpoint, NioEndpoint).", "justification": "code_not_present" } }, { "id": "CVE-2017-5650", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.3" } ], "bom-ref": "urn:uuid:024d1de5-71c7-5aba-acde-e49142a0be11", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-5650 does not affect version 8.5.78-tuxcare.3 of org.apache.tomcat:tomcat. Apache Tomcat 8.5.78 is not affected by CVE-2017-5650. The vulnerability (HTTP/2 GOAWAY frames not closing streams waiting for WINDOW_UPDATE, causing thread exhaustion) was fixed in upstream commit 51eba9b70c by Mark Thomas (markt@apache.org). This fix was already present in the upstream release 8.5.78 that TuxCare onboarded, as confirmed by the fix commit being an ancestor of the first TuxCare commit fb98844404.", "justification": "code_not_present" } }, { "id": "CVE-2017-5664", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.3" } ], "bom-ref": "urn:uuid:08c1b3a5-a555-58f3-b3d3-3f0f3b3a8e48", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-5664 does not affect version 8.5.78-tuxcare.3 of org.apache.tomcat:tomcat. Target Apache Tomcat 8.5.78 is NOT AFFECTED by CVE-2017-5664. The vulnerability affects Tomcat versions 8.5.0 to 8.5.14, but version 8.5.78 already contains the upstream fix. Commit 29893e66111d33cfe99dd01cb146317c0c262ef4 (authored by Mark Thomas on May 2, 2017) added DispatcherType.ERROR checks in both DefaultServlet and WebdavServlet service() methods, forcing all error dispatches to be processed via doGet() regardless of the original HTTP method. This fix was shipped in the upstream Apache Tomcat 8.5.78 release and was present when TuxCare onboarded the version (commit fb98844404). The vulnerable pattern (allowing write methods like PUT/DELETE to execute on static error pages during error dispatch) no longer exists in the codebase.", "justification": "code_not_present" } }, { "id": "CVE-2017-7674", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.3" } ], "bom-ref": "urn:uuid:6d4697df-24e3-57f4-a0f2-4f64138286b7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-7674 does not affect version 8.5.78-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 The target (Apache Tomcat 8.5.78) is not affected by CVE-2017-7674. The vulnerability (missing Vary header in CORS Filter responses leading to cache poisoning) was fixed in upstream Apache Tomcat 8.5.16 (May 2017) via commit 9044c1672b, and further refined in commit d8db00eb64 (July 2018). Both fixes were already present in the upstream 8.5.78 release that TuxCare onboarded (commit fb98844404)....", "justification": "code_not_present" } }, { "id": "CVE-2017-7675", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.3" } ], "bom-ref": "urn:uuid:838f3d26-8a56-55f1-967b-403ab9de04d3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-7675 does not affect version 8.5.78-tuxcare.3 of org.apache.tomcat:tomcat. Apache Tomcat 8.5.78 is NOT affected by CVE-2017-7675. The vulnerability (bypassing security constraints via path parameter stripping in HTTP/2 requests) was fixed in upstream Apache Tomcat by commit dacb030b85 on May 24, 2017. This fix was already present in the upstream Apache Tomcat 8.5.78 release that TuxCare onboarded in September 2026. The fix changes HTTP/2 `:path` header processing in Stream.java to set the URI as bytes (preserving path parameters) instead of as String (which stripped them), ensuring downstream security checks receive the complete path.", "justification": "code_not_present" } }, { "id": "CVE-2019-0221", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.3" } ], "bom-ref": "urn:uuid:214736b6-04e5-5fd7-9b21-266af1e08355", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-0221 does not affect version 8.5.78-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2019-0221 affects the SSI printenv command which echoed user-provided data without HTML entity encoding, enabling XSS attacks. The target Apache Tomcat 8.5.78 contains the upstream fix from commit 4fcdf706f3 (March 11, 2019) which adds HTML entity encoding via the ENCODING_ENTITY parameter to getVariableValue() calls. This fix applies Escape.htmlElementContent() to escape special characters...", "justification": "code_not_present" } }, { "id": "CVE-2019-17569", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.3" } ], "bom-ref": "urn:uuid:f4adfc7e-a0a8-5e07-a750-102bdcbcc233", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-17569 does not affect version 8.5.78-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 Apache Tomcat 8.5.78 is not affected by CVE-2019-17569. The vulnerability was a regression introduced in versions 8.5.48-8.5.50 where invalid Transfer-Encoding headers were silently ignored instead of rejected, potentially enabling HTTP Request Smuggling. The fix (proper validation and rejection with HTTP 400 error) was implemented by Apache upstream in December 2019 and was already present in ...", "justification": "code_not_present" } }, { "id": "CVE-2020-11996", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.3" } ], "bom-ref": "urn:uuid:23d10102-3970-5e86-9b28-f0899425f349", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-11996 does not affect version 8.5.78-tuxcare.3 of org.apache.tomcat:tomcat. CVE-2020-11996 affects Apache Tomcat 8.5.0 to 8.5.55. The target repository is version 8.5.78, which contains the upstream fix committed by Mark Thomas (markt@apache.org) in May-September 2020. The vulnerable code pattern - a loop iterating through numeric stream ID ranges - has been replaced with iteration over actual existing streams using ConcurrentNavigableMap.subMap(). This prevents CPU exhaustion when processing HTTP/2 requests with large stream ID gaps. The fix was present in upstream tag 8.5.56 and was already included when TuxCare onboarded version 8.5.78.", "justification": "code_not_present" } }, { "id": "CVE-2020-13934", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.3" } ], "bom-ref": "urn:uuid:93da7cc8-ba3d-50fd-b7aa-e60d5ee0d47f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-13934 does not affect version 8.5.78-tuxcare.3 of org.apache.tomcat:tomcat. Target version 8.5.78 is not affected by CVE-2020-13934. The vulnerability (failure to release HTTP/1.1 processor after h2c upgrade leading to memory exhaustion) was fixed in upstream Apache Tomcat by commit 923d834500 authored by Mark Thomas (markt@apache.org). This fix was included in the upstream 8.5.78 release, which is newer than the last affected version (8.5.56). The target repository contains the complete fix: the HTTP/1.1 processor is properly released via `release(processor)` before creating the HTTP/2 upgrade processor, and the control flow correctly uses `state = SocketState.CLOSED` to trigger cleanup.", "justification": "code_not_present" } }, { "id": "CVE-2020-13935", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.3" } ], "bom-ref": "urn:uuid:699b597e-52f9-5095-97ac-0185201e59af", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-13935 does not affect version 8.5.78-tuxcare.3 of org.apache.tomcat:tomcat. CVE-2020-13935 affects Apache Tomcat 8.5.0 to 8.5.56. The target version 8.5.78 is beyond this range and already contains the upstream fix (commit 12d715676038ef). The fix validates that the MSB of 64-bit WebSocket payload lengths is not set (checking if payloadLength < 0 after conversion to signed long), preventing infinite loops from malformed frames. The vulnerable pattern is not present in the target because the fix was shipped in the upstream Apache Tomcat 8.5.78 release that TuxCare onboarded, not backported later. All WebSocket frame processing (WsFrameClient and WsFrameServer) inherits from WsFrameBase, ensuring comprehensive coverage.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M1, < 9.0.37; >= 8.5.0, < 8.5.57; >= 7.0.27, < 7.0.105; >= 7.0.27, < 7.0.105; >= 8.5.0, < 8.5.57; >= 9.0.0.M1, < 9.0.37; >= 10.0.0-M1, < 10.0.0-M7; >= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M1, < 9.0.37; >= 8.5.0, < 8.5.57; >= 7.0.27, < 7.0.105), NVD (>= 7.0.27, <= 7.0.104; >= 8.5.0, <= 8.5.56; >= 9.0.1, <= 9.0.36; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6), cve.org (>= 10.0.0-M1, <= 10.0.0-M6; >= 9.0.0.M1, <= 9.0.36; >= 8.5.0, <= 8.5.56; >= 7.0.27, <= 7.0.104), Snyk (<= 0; >= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M1, < 9.0.37; >= 8.5.0, < 8.5.57).", "justification": "code_not_present" } }, { "id": "CVE-2020-1935", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.3" } ], "bom-ref": "urn:uuid:2c24c655-ab8b-5348-b019-7e110e6129a4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-1935 does not affect version 8.5.78-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 Apache Tomcat 8.5.78 is not affected by CVE-2020-1935. The vulnerability was fixed by Apache upstream in version 8.5.51 (January 2020) through stricter HTTP header parsing. The target contains the vendor's final fix strategy: (1) rejection of bare CR (carriage return not followed by line feed), (2) rejection of control characters in header values (except TAB), and (3) acceptance of bare LF as a...", "justification": "code_not_present" } }, { "id": "CVE-2020-8022", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.3" } ], "bom-ref": "urn:uuid:bc2c3cad-d47d-5ad3-b197-d71142781e69", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2020-8022 is a false positive for org.apache.tomcat:tomcat 8.5.78-tuxcare.3." } }, { "id": "CVE-2021-30639", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.3" } ], "bom-ref": "urn:uuid:fcd436af-c69d-5782-b9b6-8b423a37c0f1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-30639 does not affect version 8.5.78-tuxcare.3 of org.apache.tomcat:tomcat. The target repository (Apache Tomcat 8.5.78) is not affected by CVE-2021-30639. The vulnerability, which caused persistent error states in non-blocking I/O operations leading to denial of service, was fixed in upstream version 8.5.65 by adding `errorException = null;` to the Request.recycle() method. Since the target version 8.5.78 is later than 8.5.65, the fix was already present in the upstream release that TuxCare onboarded. The vulnerable pattern (failing to reset errorException between requests) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.3, < 10.0.5; >= 9.0.0, < 9.0.45; < 8.5.65), NVD (= 8.5.64; = 9.0.44; = 10.0.3; = 10.0.4), cve.org (>= 10.0.3, <= 10.0.4; = 10; = 9; = 9.0.44; = 8.5; = 8.5.64), Snyk (>= 10.0.3, < 10.0.5; >= 9.0.44, < 9.0.45; >= 8.5.64, < 8.5.65; >= 10.0.3, < 10.0.5; >= 9.0.44, < 9.0.45; >= 8.5.64, < 8.5.65; >= 10.0.3, < 10.0.5; >= 9.0.44, < 9.0.45; >= 8.5.64, < 8.5.65).", "justification": "code_not_present" } }, { "id": "CVE-2021-30640", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.3" } ], "bom-ref": "urn:uuid:f64d0f58-3f62-5dbe-8387-e8af398a65f9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-30640 does not affect version 8.5.78-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 Apache Tomcat 8.5.78 is not affected by CVE-2021-30640. The vulnerability (authentication bypass via special characters in usernames in JNDI Realm) was fixed in upstream Apache Tomcat releases before version 8.5.78. The fix commits (24dfb30076 and related) by Mark Thomas added proper RFC 4514 attribute value escaping and RFC 2254 filter escaping to all LDAP operations, preventing special charac...", "justification": "code_not_present" } }, { "id": "CVE-2021-33037", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.3" } ], "bom-ref": "urn:uuid:a24f3d47-7807-5799-8896-0cc90cb5cc35", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-33037 does not affect version 8.5.78-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2021-33037 does not affect Tomcat 8.5.78. The vulnerability affected versions 8.5.0 to 8.5.66. Apache Tomcat fixed this issue in May 2021 (commits 19d11556d0, eee0d024, and 506134f9), and the fixes were included in upstream release 8.5.67 and later. The target version 8.5.78 already contains all three required fixes: (1) rejects \"identity\" transfer encoding with 501 response, (2) processes ...", "justification": "code_not_present" } }, { "id": "CVE-2021-41079", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.3" } ], "bom-ref": "urn:uuid:ea9b9dee-b321-5f8d-a48f-4c3f607745ba", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-41079 does not affect version 8.5.78-tuxcare.3 of org.apache.tomcat:tomcat. Apache Tomcat 8.5.78-tuxcare.3 is not affected by CVE-2021-41079. Both required fixes for the infinite loop vulnerability in OpenSSLEngine.unwrap() were already present in the upstream Apache Tomcat 8.5.78 release before TuxCare onboarded it. The vulnerable code patterns (break statements that would cause infinite loops) are not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.4; >= 9.0.0, < 9.0.44; >= 8.5.0, < 8.5.64), NVD (>= 8.5.0, < 8.5.64; >= 9.0.0, < 9.0.44; >= 10.0.0, <= 10.0.2), cve.org (>= 8.5.0, <= 8.5.63; = 8.5; >= 9.0.0-M1, <= 9.0.43; = 9; >= 10.0.0-M1, <= 10.0.2; = 10), Snyk (>= 10.0.0, < 10.0.4; >= 8.0.0, < 8.5.64; >= 9.0.0, < 9.0.44; >= 10.0.0, < 10.0.4; >= 8.0.0, < 8.5.64; >= 9.0.0, < 9.0.44; >= 10.0.0, < 10.0.4; >= 8.0.0, < 8.5.64; >= 9.0.0, < 9.0.44).", "justification": "code_not_present" } }, { "id": "CVE-2021-42340", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.3" } ], "bom-ref": "urn:uuid:84959f4d-8e80-5496-a0fc-5dab86e15092", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-42340 does not affect version 8.5.78-tuxcare.3 of org.apache.tomcat:tomcat. Target version 8.5.78 is NOT vulnerable to CVE-2021-42340. The fix for the WebSocket memory leak was already included in the upstream Apache Tomcat 8.5.78 release (March 2022) before TuxCare onboarded this version. The vulnerable pattern (failure to close WebConnection objects in WsHttpUpgradeHandler) is not present in the target code.", "justification": "code_not_present" } }, { "id": "CVE-2021-43980", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.3" } ], "bom-ref": "urn:uuid:7cd16072-494c-526f-a646-d39bd4e61706", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-43980 does not affect version 8.5.78-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 Target version 8.5.78 is NOT affected by CVE-2021-43980. The CVE explicitly states affected versions are \"8.5.0 to 8.5.77\" - version 8.5.78 is excluded. The upstream fix (commit 4a00b0c0890538b9d by Mark Thomas on 2022-03-29) was included in Tomcat 8.5.78 release (2022-04-01), which TuxCare onboarded with the fix already present. The vulnerable pattern (non-atomic processor ownership allowing c...", "justification": "code_not_present" } }, { "id": "CVE-2022-23181", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.3" } ], "bom-ref": "urn:uuid:7129483e-ca16-5358-a109-76801ed6e275", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-23181 does not affect version 8.5.78-tuxcare.3 of org.apache.tomcat:tomcat. CVE-2022-23181 does not affect Tomcat 8.5.78. The vulnerability is a TOCTOU (Time of Check Time of Use) issue in FileStore.java where file.getCanonicalFile() was called during a security check but the original file object was returned, allowing local attackers to bypass path traversal protections via symlink manipulation. The fix stores the canonical file in a variable and uses it consistently. According to Apache's security advisory, the affected version range is 8.5.55 to 8.5.73. Version 8.5.78 was released after the fix and already contains the upstream patch (commit 97943959 by Mark Thomas, committed 2022-01-12). TuxCare onboarded version 8.5.78 on 2026-09-20, and the fix was already present in that upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.16; >= 9.0.0, < 9.0.58; < 8.5.75), NVD (>= 8.5.55, <= 8.5.73; >= 9.0.35, <= 9.0.56; >= 10.0.1, <= 10.0.14; = 10.0.0-milestone10; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9; = 10.1.0-milestone1; = 10.1.0-milestone2; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8), cve.org (>= 10.1.0-M1, <= 10.1.0-M8; = 10.1; >= 10.0.0-M5, <= 10.0.14; = 10.0; >= 9.0.35, <= 9.0.56; = 9; >= 8.5.55, <= 8.5.73; = 8), Snyk (>= 8.5.55, < 8.5.74; >= 9.0.0, < 9.0.57; >= 10.0.0-M1, < 10.0.15; >= 10.1.0-M1, < 10.1.0-M9; >= 8.5.55, < 8.5.75; >= 9.0.0, < 9.0.58; >= 10.0.0-M1, < 10.0.16; >= 10.1.0-M1, < 10.1.0-M10).", "justification": "code_not_present" } }, { "id": "CVE-2022-25762", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.3" } ], "bom-ref": "urn:uuid:4b87756b-7e56-5d2e-9923-1c9e5aa1d988", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-25762 does not affect version 8.5.78-tuxcare.3 of org.apache.tomcat:tomcat. CVE-2022-25762 was fixed in Apache Tomcat 8.5.76 (released February 28, 2022). The target is running version 8.5.78, which already contains the upstream fix. The fix commit 01f2cf25b2 by Mark Thomas (markt@apache.org) was present in the upstream release before TuxCare onboarded it. The vulnerable WebSocket connection handling pattern is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.0, < 8.5.75; >= 9.0.0M1, < 9.0.20), NVD (>= 8.5.0, < 8.5.76; >= 9.0.0, < 9.0.21), cve.org (>= 9.0.0.M1, <= 9.0.20; = 9; >= 8.5.0, <= 8.5.75; = 8.5), Snyk (>= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21; >= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21; >= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21; >= 8.5.0, < 8.5.76; >= 9.0.0.M1, < 9.0.21).", "justification": "code_not_present" } }, { "id": "CVE-2022-29885", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.3" } ], "bom-ref": "urn:uuid:c2d54362-a329-52ae-9313-3dac0250e3dd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-29885 is fixed in version 8.5.78-tuxcare.3 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2022-34305", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.3" } ], "bom-ref": "urn:uuid:f65e948f-86ca-576a-95b7-b7a3a0f8435b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-34305 is fixed in version 8.5.78-tuxcare.3 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2023-41080", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.3" } ], "bom-ref": "urn:uuid:deb310da-5b08-53a4-881f-e928212ae46f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-41080 is fixed in version 8.5.78-tuxcare.3 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2023-42795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.3" } ], "bom-ref": "urn:uuid:3911bb1d-487f-55ae-9b31-b55e573c3d81", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-42795 affects version 8.5.78-tuxcare.3 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2023-45648", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.3" } ], "bom-ref": "urn:uuid:f6141d0a-fb59-5263-9e99-9a7327784af1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-45648 affects version 8.5.78-tuxcare.3 of org.apache.tomcat:tomcat, and is fixed in 8.5.78-tuxcare.5." } }, { "id": "CVE-2024-54677", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.3" } ], "bom-ref": "urn:uuid:c529b543-4de7-5b5f-8d92-143964beb19d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-54677 affects version 8.5.78-tuxcare.3 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2025-49124", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.3" } ], "bom-ref": "urn:uuid:9cba9955-3de2-5cd0-9a5a-214de0522405", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49124 affects version 8.5.78-tuxcare.3 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2025-55752", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.3" } ], "bom-ref": "urn:uuid:6dac02a6-80a8-5a20-87f5-a838f127ad4c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-55752 is fixed in version 8.5.78-tuxcare.3 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2025-55754", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.3" } ], "bom-ref": "urn:uuid:b1f62530-5d80-5d5f-8d48-bd1a904c3c30", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-55754 is fixed in version 8.5.78-tuxcare.3 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2025-61795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.3" } ], "bom-ref": "urn:uuid:499c1615-9ad8-50e1-8390-aa1d49231f7d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-61795 is fixed in version 8.5.78-tuxcare.3 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2025-66614", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.3" } ], "bom-ref": "urn:uuid:2841caf4-4b7d-5e21-a535-7b5c5a57f297", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66614 affects version 8.5.78-tuxcare.3 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-25854", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.3" } ], "bom-ref": "urn:uuid:15728806-8845-554a-9c90-734465f3cac2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25854 is fixed in version 8.5.78-tuxcare.3 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-29129", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.3" } ], "bom-ref": "urn:uuid:319f6870-fa6e-5765-bbb3-70d724ee3295", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-29129 does not affect version 8.5.78-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 Apache Tomcat 8.5.78 is not affected by CVE-2026-29129. The vulnerability was introduced in later versions (9.0.114+, 10.1.51+, 11.0.16+) when TLS 1.3 cipher suite support was added. Version 8.5.78 lacks the TLS 1.3 cipher suite merging code that used HashSet instead of LinkedHashSet, causing cipher order to not be preserved. The target version uses a simpler code path that already preserves ci...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-29145", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.3" } ], "bom-ref": "urn:uuid:f2627eb5-1fbc-5817-906e-0dfa633df520", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-29145 does not affect version 8.5.78-tuxcare.3 of org.apache.tomcat:tomcat. Prechecker: No vulnerable code from the fix was found, and this version calls none of the distinctive methods on the lines the fix removes. Version 8.5.78 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-95jq-rwvf-vjx4 (newer lines only), NVD (newer lines only), CVE record (newer lines only).", "justification": "code_not_present" } }, { "id": "CVE-2026-29146", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.3" } ], "bom-ref": "urn:uuid:acf314b3-0249-5302-a267-b41ab6c353ba", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29146 is fixed in version 8.5.78-tuxcare.3 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-32990", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.3" } ], "bom-ref": "urn:uuid:2e28a81a-df10-51f9-a7f5-a0a1d4e76074", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-32990 does not affect version 8.5.78-tuxcare.3 of org.apache.tomcat:tomcat. not_affected \u2014 Apache Tomcat 8.5.78 is not affected by CVE-2026-32990. The vulnerability requires the checkSni() method introduced in CVE-2025-66614, which was backported to version 8.5.100. Version 8.5.78 predates this feature and lacks the vulnerable code path entirely. The SNI validation framework that compares protocol hostname with SNI hostname does not exist in 8.5.78.", "justification": "code_not_present" } }, { "id": "CVE-2026-34483", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.3" } ], "bom-ref": "urn:uuid:6c672bcd-f9a8-5460-be08-300d3dc560bf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34483 affects version 8.5.78-tuxcare.3 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-34486", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.3" } ], "bom-ref": "urn:uuid:6ccc4e73-ea45-5f79-8862-462af9a3b1e5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34486 affects version 8.5.78-tuxcare.3 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-34487", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.3" } ], "bom-ref": "urn:uuid:5d3ccd99-4984-5a7f-8ce1-3e28c3045b5a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-34487 does not affect version 8.5.78-tuxcare.3 of org.apache.tomcat:tomcat. Prechecker: No vulnerable code from the fix was found; the classes the fix changes and their component are absent from this version. Version 8.5.78 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-x4m4-345f-5h5g (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (newer lines only).", "justification": "code_not_present" } }, { "id": "CVE-2026-41284", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.3" } ], "bom-ref": "urn:uuid:471c53a8-8f5f-5f08-a99c-bd5dca6906d7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41284 affects version 8.5.78-tuxcare.3 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-41293", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.3" } ], "bom-ref": "urn:uuid:305a2fe2-c6e7-5622-81c8-8d291dc2cad3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41293 affects version 8.5.78-tuxcare.3 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-42498", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.3" } ], "bom-ref": "urn:uuid:4c696893-19e2-5df5-bd37-f2a69a05691d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42498 affects version 8.5.78-tuxcare.3 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-43512", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.3" } ], "bom-ref": "urn:uuid:a3ce5299-d6ee-5778-b677-969d923707d2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43512 affects version 8.5.78-tuxcare.3 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-43513", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.3" } ], "bom-ref": "urn:uuid:c0fc80ad-5bb6-541a-89d7-d99fa135d32f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43513 affects version 8.5.78-tuxcare.3 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-43514", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.3" } ], "bom-ref": "urn:uuid:21a2b13b-3e88-5950-8443-edcc3b0f6bde", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43514 affects version 8.5.78-tuxcare.3 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-43515", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.3" } ], "bom-ref": "urn:uuid:e0b371aa-04e3-59ce-9ff4-fff24442fc1e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43515 affects version 8.5.78-tuxcare.3 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-50229", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.3" } ], "bom-ref": "urn:uuid:495ab3b0-43b4-5c5a-8662-d10f5f9ee2e8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50229 affects version 8.5.78-tuxcare.3 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-53404", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.3" } ], "bom-ref": "urn:uuid:597dd357-23a7-502e-8311-37c4a1556765", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53404 affects version 8.5.78-tuxcare.3 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-55276", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.3" } ], "bom-ref": "urn:uuid:cd3152ba-90d0-5d60-86ae-a0e837944f5d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-55276 affects version 8.5.78-tuxcare.3 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-55955", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.3" } ], "bom-ref": "urn:uuid:8d3ab4ae-fbb3-56ad-8664-7998365c3864", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-55955 affects version 8.5.78-tuxcare.3 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-55956", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.3" } ], "bom-ref": "urn:uuid:d59a78f4-c7bf-5013-8028-69a5fc8246a3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-55956 affects version 8.5.78-tuxcare.3 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-55957", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.3" } ], "bom-ref": "urn:uuid:c82002ec-ba88-51ca-980f-4c3ce3021ffe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-55957 affects version 8.5.78-tuxcare.3 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-65182", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.3" } ], "bom-ref": "urn:uuid:6923d23d-f8f9-5795-bed8-19d7b4cbcb78", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65182 affects version 8.5.78-tuxcare.3 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-65905", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.3" } ], "bom-ref": "urn:uuid:b55ecf7a-61fb-59bd-b419-59aedab3e2d8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65905 affects version 8.5.78-tuxcare.3 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-68525", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.3" } ], "bom-ref": "urn:uuid:7cdc4f47-c7c5-57ea-ad40-09c76977abda", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-68525 affects version 8.5.78-tuxcare.3 of org.apache.tomcat:tomcat." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.78-tuxcare.3" } ] }