{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:ebd65314-6c29-5f38-ba1b-8c7164dc2686", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat-catalina", "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@7.0.109-tuxcare.7", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@7.0.109-tuxcare.7", "version": "7.0.109-tuxcare.7", "pedigree": { "ancestors": [ { "name": "tomcat-catalina", "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@7.0.109", "type": "library", "group": "org.apache.tomcat", "version": "7.0.109" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-5388", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:2d67cb14-eb18-542e-90cf-909186f6458a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-5388 does not affect version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat-catalina. The target (Apache Tomcat 7.0.109) is NOT AFFECTED by CVE-2016-5388 (httpoxy). The vulnerable code pattern has been removed by an upstream fix that was already present in the Tomcat 7.0.109 release when TuxCare onboarded it. The fix (commit 880250877b by markt@apache.org) replaced a blacklist approach (blocking only AUTHORIZATION/PROXY_AUTHORIZATION headers) with a whitelist pattern that excludes the dangerous \"Proxy\" header from being passed as HTTP_PROXY to CGI processes. The envHttpHeadersPattern defense is active at java/org/apache/catalina/servlets/CGIServlet.java:1146-1148.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.0.0, < 7.0.72; >= 8.0.0, < 8.5.5), NVD (>= 6.0, <= 6.0.45; >= 7.0, <= 7.0.70; >= 8.0, <= 8.5.4), Snyk (>= 7.35, < 8.5.5; >= 7.35, < 8.5.5).", "justification": "code_not_present" } }, { "id": "CVE-2016-8735", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:6f5d0c5b-68ae-511f-8997-84aa0c4e49f8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-8735 does not affect version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat-catalina. CVE-2016-8735: Target version 7.0.109 is NOT AFFECTED. The vulnerability (missing credential type restrictions in JmxRemoteLifecycleListener allowing remote code execution via malicious JMX credential objects) was fixed in upstream Apache Tomcat 7.0.73. Version 7.0.109 > 7.0.73, so the fix was already present when TuxCare onboarded this version. Both defensive measures are implemented: (1) explicit credential type restriction to String[] and String classes (lines 277-279), and (2) proper stub usage via server.toStub() (line 333). The fix was authored by upstream Apache developers (Mark Thomas, markt@apache.org) in commit 7e3a037055c on 2016-11-02, predating TuxCare's onboarding commit 1ec77923c0.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 6.0.48; >= 7.0.0, < 7.0.73; >= 8.0.0, < 8.0.39; >= 8.5.0, < 8.5.7; >= 9.0.0.M1, < 9.0.0.M12; < 6.0.48; >= 7.0.0, < 7.0.73; >= 8.0.0, < 8.0.39; >= 8.5.0, < 8.5.7; >= 9.0.0.M1, < 9.0.0.M12), NVD (< 6.0.48; >= 7.0.0, < 7.0.73; >= 8.0, < 8.0.39; >= 8.5.0, < 8.5.7; = 9.0.0; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (< 6.0.48; >= 7, < 7.0.73; >= 8, < 8.0.39; >= 8.5, < 8.5.7; >= 9, < 9.0.0.M12), Snyk (>= 6, < 6.0.48; >= 7.0.0, < 7.0.73; >= 8, < 8.0.39; >= 8.5.0, < 8.5.8; >= 9-alpha, < 9.0.0.M13).", "justification": "code_not_present" } }, { "id": "CVE-2017-12616", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:045fa6aa-3c20-514f-a178-700e0711f402", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-12616 does not affect version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat-catalina. CVE-2017-12616 is not present in the target. The vulnerability pattern was fixed by Apache in Tomcat 7.0.81 (commit 07dc0ea2745f, dated 2017-08-10). The target version 7.0.109 already contained this upstream fix when TuxCare onboarded it. All critical file operations (bind, rebind, rename, createSubcontext) properly route through the file() method which calls validate() to check that canonical paths remain within the document root, preventing path traversal attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.0.0, < 7.0.81), NVD (= 7.0.0; = 7.0.0-beta; = 7.0.1; = 7.0.2; = 7.0.2-beta; = 7.0.3; = 7.0.4; = 7.0.4-beta; = 7.0.5; = 7.0.5-beta; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 7.0.76; = 7.0.77; = 7.0.79; = 7.0.80), cve.org (>= 7.0.0, <= 7.0.80), Snyk (>= 7.0.0, < 7.0.81).", "justification": "code_not_present" } }, { "id": "CVE-2017-12617", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:10d963a6-189b-5416-b808-40e05a4742b6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-12617 does not affect version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat-catalina. already_fixed \u2014 Apache Tomcat 7.0.109 is outside the affected range for CVE-2017-12617 (7.0.0\u20137.0.81). The vulnerability was fixed upstream in 7.0.82, with a follow-up correction in 7.0.89, so 7.0.109 carries the complete fix. The affected components \u2014 FileDirContext, VirtualDirContext, JrePlatform and DefaultServlet \u2014 are byte-identical to the corresponding files in the upstream Apache Tomcat 7.0.109 release, and the upstream regression tests for this CVE are present and unmodified.", "justification": "code_not_present" } }, { "id": "CVE-2017-5648", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:c2a2b578-7247-575e-9242-2a38ecfd744d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-5648 does not affect version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat-catalina. CVE-2017-5648 affects Apache Tomcat 7.0.0-7.0.75", "justification": "code_not_present" } }, { "id": "CVE-2019-0221", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:95b2ae9c-0038-5152-9df9-259ac1b58ec0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-0221 does not affect version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat-catalina. not_affected \u2014 CVE-2019-0221 is NOT present in Tomcat 7.0.109. The vulnerability affected SSI printenv command's lack of HTML entity encoding (versions 7.0.0-7.0.93). The target already contains the upstream fix (commit 44ec74c44d by Mark Thomas, 2019-03-11) which adds entity encoding via SSIMediator.ENCODING_ENTITY. This fix was shipped in the upstream Apache Tomcat 7.0.109 release that TuxCare onboarded on ...", "justification": "code_not_present" } }, { "id": "CVE-2020-9484", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:b12569c1-239c-547d-966b-86b97e26b6ef", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-9484 does not affect version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat-catalina. Tomcat 7.0.109 is not vulnerable as it is higher than upstream fix version - 7.0.108", "justification": "code_not_present" } }, { "id": "CVE-2022-45143", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:7c3d7f8b-f962-53f3-8f9c-6bda251c9cce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-45143 is fixed in version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2023-24998", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:e998e7ce-66af-5ab0-9e65-0612313bcd38", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-24998 affects version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2023-28708", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:ad8f0a21-aba0-5896-b6e5-c3b6b78ea286", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-28708 is fixed in version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2023-41080", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:c5cc835b-f9e6-512d-bc2c-d0d007bff4f7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-41080 is fixed in version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2023-42795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:36ce5c89-5171-5e91-ad5d-d71c3dcc870c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-42795 affects version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2023-46589", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:82bbfb6d-da88-5f16-8651-6ce64bf856c0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-46589 is fixed in version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2024-50379", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:59a0f8d0-c749-5cb8-85ab-38af1572f5e2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-50379 affects version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2024-52316", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:712f20c1-61df-5404-95e0-873a196b2a64", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-52316 affects version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2024-56337", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:4f935a65-4480-569f-a785-e3af6043ebd7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-56337 affects version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-24813", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:02790223-fc48-5865-b5a0-abfc531d1de2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-24813 affects version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-31651", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:8c1e8d42-2928-56a5-85c3-27471cf70a3f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-31651 is fixed in version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-46701", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:2a28215d-2b14-51c9-afef-e9e558781f6e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-46701 is fixed in version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-48988", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:ccb2e639-8a1c-511d-b925-daf61cea9362", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48988 is fixed in version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-49124", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:a7d9b521-53e3-5c85-a315-568fa55912ae", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49124 affects version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-49125", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:67877f3b-3c02-5ff1-bd1d-4badd15b4cdd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-49125 does not affect version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat-catalina. Version 7.0.109 is not vulnerable. Summary: CVE-2025-49125 does not affect this Tomcat instance. The target is running Tomcat 7.0.109, which predates the introduction of the vulnerable PreResources/PostResources features. These features were introduced in Tomcat 8.0 as part of the WebResourceRoot API. The CVE explicitly lists only Tomcat 9.x, 10.x, and 11.x as affected versions.", "justification": "code_not_present" } }, { "id": "CVE-2025-52520", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:e5909e6c-4595-5bf5-bb27-d7ae0a5a2695", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-52520 affects version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-55668", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:2ad03034-bfe7-5b07-9c88-f7ceec76503d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-55668 does not affect version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat-catalina. not_affected \u2014 CVE-2025-55668 is a session fixation vulnerability in Apache Tomcat's RewriteValve component, which processes redirects without properly encoding session IDs. However, Tomcat 7.0.109 does not contain the RewriteValve component at all. RewriteValve was introduced in Tomcat 8.0 (January 2013) and never existed in the Tomcat 7 branch. Exhaustive searches of the codebase, directory structure, and g...", "justification": "code_not_present" } }, { "id": "CVE-2025-55752", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:5ae30c04-574c-5211-a984-5ba906ed75cc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55752 affects version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-55754", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:388c3cb4-0ab0-5cfc-9da1-1629c0a87e86", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55754 affects version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-61795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:67a98055-02fe-51b4-89eb-87e85b4fa2b4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-61795 is fixed in version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-25854", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:0042da8f-be9b-5717-824e-17f3ca1e2178", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-25854 does not affect version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat-catalina. not_affected \u2014 Target Apache Tomcat 7.0.109 is not affected by CVE-2026-25854. The vulnerable component LoadBalancerDrainingValve does not exist in this version. The valve was introduced in Tomcat 8.5.30 (backport on 2018-03-29), 9.0.0-M23 (original on 2017-06-21), and later versions. Version 7.0.109 predates the introduction of this component entirely.", "justification": "code_not_present" } }, { "id": "CVE-2026-34483", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:d5064b0a-c3e6-5a4d-81d9-48c1a3cc74ff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34483 affects version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-41284", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:7eaa656f-253b-5076-986a-ea0e05ecbb05", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41284 affects version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-42498", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:616a321f-b8df-55e0-8784-007a37e23d4e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42498 affects version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-43512", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:78e1dd1b-edd9-5ef9-9518-eed4d7ec0337", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43512 affects version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-43513", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:077680ac-e276-5326-8eb4-0f81512b6642", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43513 affects version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-43514", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:3294c105-c4ed-56e7-9e9d-f9bc5da268bb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43514 affects version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-43515", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:f68abfc5-3b9c-5e8f-a095-d20a6e2c50bb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43515 affects version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-53404", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:a99dcfd7-74a4-5a16-9c55-49fdbe530840", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53404 affects version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-55956", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:fcdfc3ab-cb3f-5836-8751-f8f7533ccb5e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-55956 affects version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-55957", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:32a12428-d97d-5b4d-a7be-f17203cec917", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-55957 affects version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-65182", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:48ec03e6-ca32-5a51-97a0-984dfc6aba16", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65182 affects version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-65905", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:42dd79de-d0ef-5724-9d89-8c38cc805f7c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65905 affects version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-68525", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@7.0.109-tuxcare.7" } ], "bom-ref": "urn:uuid:0220083a-1697-5c21-ae3f-1aab1c1dacc0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-68525 affects version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat-catalina." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@7.0.109-tuxcare.7" } ] }