{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:48790f63-4e0b-5e21-8f05-5e2956523775", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat-catalina", "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.13-tuxcare.2", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.13-tuxcare.2", "version": "9.0.13-tuxcare.2", "pedigree": { "ancestors": [ { "name": "tomcat-catalina", "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.13", "type": "library", "group": "org.apache.tomcat", "version": "9.0.13" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-5388", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.13-tuxcare.2" } ], "bom-ref": "urn:uuid:c87d1594-fd6d-56e5-a452-f249be01c0fa", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-5388 does not affect version 9.0.13-tuxcare.2 of org.apache.tomcat:tomcat-catalina. CVE-2016-5388 (httpoxy) is NOT present in Tomcat 9.0.13. The fix was applied by Apache upstream in August 2016 (commit fb3569fbb9) and was already included in the Tomcat 9.0.13 release that TuxCare onboarded. The vulnerable code pattern (passing all HTTP headers except AUTHORIZATION/PROXY_AUTHORIZATION to CGI environment) has been replaced with an allowlist approach that blocks the \"Proxy\" header from becoming HTTP_PROXY. Verified at java/org/apache/catalina/servlets/CGIServlet.java lines 297-298 (allowlist pattern) and 1077-1079 (enforcement logic).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.0.0, < 7.0.72; >= 8.0.0, < 8.5.5), NVD (>= 6.0, <= 6.0.45; >= 7.0, <= 7.0.70; >= 8.0, <= 8.5.4), Snyk (>= 7.35, < 8.5.5; >= 7.35, < 8.5.5).", "justification": "code_not_present" } }, { "id": "CVE-2016-8735", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.13-tuxcare.2" } ], "bom-ref": "urn:uuid:b325c38c-36f8-5cd7-9166-73632bf15303", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-8735 does not affect version 9.0.13-tuxcare.2 of org.apache.tomcat:tomcat-catalina. CVE-2016-8735 affects Apache Tomcat 9.x before 9.0.0.M12. The target is Tomcat 9.0.13, which already contains the upstream fix. The vulnerability involved unrestricted deserialization of JMX authentication credentials in JmxRemoteLifecycleListener. The fix restricts credential types to String[] and String classes only, preventing arbitrary object deserialization. Both components of the fix are present in the target: (1) credential type restriction at line 269, and (2) server.toStub() usage at line 325. The fix was authored by Mark Thomas (markt@apache.org) and shipped in upstream release 9.0.0.M12 (November 2, 2016), which predates the 9.0.13 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 6.0.48; >= 7.0.0, < 7.0.73; >= 8.0.0, < 8.0.39; >= 8.5.0, < 8.5.7; >= 9.0.0.M1, < 9.0.0.M12; < 6.0.48; >= 7.0.0, < 7.0.73; >= 8.0.0, < 8.0.39; >= 8.5.0, < 8.5.7; >= 9.0.0.M1, < 9.0.0.M12), NVD (< 6.0.48; >= 7.0.0, < 7.0.73; >= 8.0, < 8.0.39; >= 8.5.0, < 8.5.7; = 9.0.0; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (< 6.0.48; >= 7, < 7.0.73; >= 8, < 8.0.39; >= 8.5, < 8.5.7; >= 9, < 9.0.0.M12), Snyk (>= 6, < 6.0.48; >= 7.0.0, < 7.0.73; >= 8, < 8.0.39; >= 8.5.0, < 8.5.8; >= 9-alpha, < 9.0.0.M13).", "justification": "code_not_present" } }, { "id": "CVE-2017-12616", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.13-tuxcare.2" } ], "bom-ref": "urn:uuid:3533ae41-f76e-5a35-a70f-2605f20faf6d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-12616 does not affect version 9.0.13-tuxcare.2 of org.apache.tomcat:tomcat-catalina. CVE-2017-12616 targets VirtualDirContext in Apache Tomcat 7.0.0-7.0.80. The target (Tomcat 9.0.13) uses a completely different architecture introduced in Tomcat 8+. VirtualDirContext was replaced by WebResourceRoot with Pre/Post-Resources (DirResourceSet). The replacement architecture has built-in canonical path validation that prevents directory traversal, equivalent to the security fix that was backported to Tomcat 7.x. The vulnerable component does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.0.0, < 7.0.81), NVD (= 7.0.0; = 7.0.0-beta; = 7.0.1; = 7.0.2; = 7.0.2-beta; = 7.0.3; = 7.0.4; = 7.0.4-beta; = 7.0.5; = 7.0.5-beta; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 7.0.76; = 7.0.77; = 7.0.79; = 7.0.80), cve.org (>= 7.0.0, <= 7.0.80), Snyk (>= 7.0.0, < 7.0.81).", "justification": "protected_at_runtime" } }, { "id": "CVE-2017-12617", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.13-tuxcare.2" } ], "bom-ref": "urn:uuid:d44d5838-1162-5e3d-8322-0b77b64e7124", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-12617 does not affect version 9.0.13-tuxcare.2 of org.apache.tomcat:tomcat-catalina. Tomcat 9.0.13 is not affected by CVE-2017-12617. The vulnerability allowed uploading JSP files via specially crafted HTTP PUT requests when readonly was disabled, exploiting trailing-slash path confusion where the Java File API silently drops trailing slashes. The upstream fixes (commits b7e0435d17 and b577f9a799 by Mark Thomas) were already included in the Tomcat 9.0.13 release that TuxCare onboarded. Both defenses are present: DirResourceSet.write() rejects file creation paths ending in '/', and AbstractFileResourceSet.file() returns null when accessing files via paths ending in '/'.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82; >= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82), NVD (>= 7.0.0, < 7.0.82; >= 8.0, < 8.0.47; >= 8.5.0, < 8.5.23; >= 9.0.0, < 9.0.1), cve.org (>= 9.0.0.M1, <= 9.0.0; >= 8.5.0, <= 8.5.22; >= 8.0.0.RC1, <= 8.0.46; >= 7.0.0, <= 7.0.81), Snyk (< 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1).", "justification": "code_not_present" } }, { "id": "CVE-2017-5648", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.13-tuxcare.2" } ], "bom-ref": "urn:uuid:b1a9b490-fee3-5d38-8743-274e22066e6e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-5648 does not affect version 9.0.13-tuxcare.2 of org.apache.tomcat:tomcat-catalina. Apache Tomcat 9.0.13 is not affected by CVE-2017-5648. The vulnerability was fixed in the upstream release before version 9.0.13. All calls to application listeners (fireRequestInitEvent/fireRequestDestroyEvent) use proper facade objects via request.getRequest(), preventing untrusted applications from retaining references to internal request/response objects and bypassing SecurityManager isolation. The fix commit (dfa40863421d7681fed893b4256666491887e38c) authored by markt@apache.org was already present in the upstream 9.0.13 release tag when TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76; >= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76), NVD (= 7.0.0; = 7.0.1; = 7.0.2; = 7.0.3; = 7.0.4; = 7.0.5; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.52; = 7.0.53; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 8.0.0; = 8.0.0-rc1; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.8; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M17; >= 8.5.0, <= 8.5.11; >= 8.0.0.RC1, <= 8.0.41; >= 7.0.0, <= 7.0.75), Snyk (>= 7.0.0, < 7.0.76; >= 8, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9-alpha, < 9.0.0.M17; >= 7.0.0, < 7.0.76; >= 8.0.0-RC1, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9.0.0.M1, < 9.0.0.M17).", "justification": "code_not_present" } }, { "id": "CVE-2019-0221", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.13-tuxcare.2" } ], "bom-ref": "urn:uuid:0a5a6988-4c97-504f-9a96-3e4b5ffe3252", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-0221 is fixed in version 9.0.13-tuxcare.2 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2020-9484", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.13-tuxcare.2" } ], "bom-ref": "urn:uuid:6fcdf652-5dde-52be-bf6e-114afec44afd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-9484 is fixed in version 9.0.13-tuxcare.2 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2022-45143", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.13-tuxcare.2" } ], "bom-ref": "urn:uuid:69e3db1f-bc84-563e-9f60-ffc486490dee", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-45143 does not affect version 9.0.13-tuxcare.2 of org.apache.tomcat:tomcat-catalina. Apache Tomcat 9.0.13 is not affected by CVE-2022-45143. The vulnerability concerns JsonErrorReportValve, a component that was introduced in Tomcat 9.0.40. Version 9.0.13 predates this introduction and does not contain the vulnerable class or any JSON error reporting functionality.", "justification": "code_not_present" } }, { "id": "CVE-2023-24998", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.13-tuxcare.2" } ], "bom-ref": "urn:uuid:5f44fde6-9c0b-5d86-92d3-604ad9abbcf8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-24998 is fixed in version 9.0.13-tuxcare.2 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2023-28708", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.13-tuxcare.2" } ], "bom-ref": "urn:uuid:ca410056-b35f-5518-963d-00af3e8ba82c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-28708 is fixed in version 9.0.13-tuxcare.2 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2023-41080", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.13-tuxcare.2" } ], "bom-ref": "urn:uuid:4434c97c-8b34-5d90-b099-b9c6557cc591", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-41080 is fixed in version 9.0.13-tuxcare.2 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2023-42795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.13-tuxcare.2" } ], "bom-ref": "urn:uuid:f7c3c651-5511-5e94-b0e7-340577030265", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-42795 is fixed in version 9.0.13-tuxcare.2 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2023-46589", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.13-tuxcare.2" } ], "bom-ref": "urn:uuid:93ac01b4-1686-505e-9ba0-d41392b40651", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-46589 affects version 9.0.13-tuxcare.2 of org.apache.tomcat:tomcat-catalina, and is fixed in 9.0.13-tuxcare.5." } }, { "id": "CVE-2024-50379", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.13-tuxcare.2" } ], "bom-ref": "urn:uuid:baf476f4-5081-5a97-a18d-3c155d3272dc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-50379 affects version 9.0.13-tuxcare.2 of org.apache.tomcat:tomcat-catalina, and is fixed in 9.0.13-tuxcare.4." } }, { "id": "CVE-2024-52316", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.13-tuxcare.2" } ], "bom-ref": "urn:uuid:f922ae6f-8019-5e01-8974-93882f8ce6a0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-52316 affects version 9.0.13-tuxcare.2 of org.apache.tomcat:tomcat-catalina, and is fixed in 9.0.13-tuxcare.4." } }, { "id": "CVE-2024-56337", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.13-tuxcare.2" } ], "bom-ref": "urn:uuid:3cf3d1a1-d490-5dfb-908e-6912df8b4b15", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-56337 affects version 9.0.13-tuxcare.2 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-24813", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.13-tuxcare.2" } ], "bom-ref": "urn:uuid:5b334bdf-5e7b-5b7c-a993-365cd71c40c2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-24813 is fixed in version 9.0.13-tuxcare.2 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-31651", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.13-tuxcare.2" } ], "bom-ref": "urn:uuid:8ef92aeb-28ff-501c-af28-6e1aacc1a7e5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31651 affects version 9.0.13-tuxcare.2 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-46701", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.13-tuxcare.2" } ], "bom-ref": "urn:uuid:67ab7dd2-da72-5453-b95d-56eebc19f4ea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-46701 is fixed in version 9.0.13-tuxcare.2 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-48988", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.13-tuxcare.2" } ], "bom-ref": "urn:uuid:9b60feca-0da3-58e7-9176-82056c9dd46d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48988 is fixed in version 9.0.13-tuxcare.2 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-49124", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.13-tuxcare.2" } ], "bom-ref": "urn:uuid:78ef02cd-9862-50b6-898d-177ae2c5ddc0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-49124 does not affect version 9.0.13-tuxcare.2 of org.apache.tomcat:tomcat-catalina. Prechecker: The scan of this version produced no finding. The advisories list this line as affected from 9.0.23, and version 9.0.13 is older. Advisories: GitHub GHSA-42wg-hm62-jcwg (affected from 9.0.23), NVD (affected from 9.0.23), CVE record (affected from 9.0.23), Snyk (affected from 9.0.23).", "justification": "code_not_present" } }, { "id": "CVE-2025-49125", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.13-tuxcare.2" } ], "bom-ref": "urn:uuid:40fd9ef3-f9e3-5ccf-803c-5ce05478248a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-49125 is fixed in version 9.0.13-tuxcare.2 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-52520", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.13-tuxcare.2" } ], "bom-ref": "urn:uuid:5e18f024-aead-55c7-a01e-2988ef1ff0f9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-52520 is fixed in version 9.0.13-tuxcare.2 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-55668", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.13-tuxcare.2" } ], "bom-ref": "urn:uuid:32ae6e1c-114b-5d39-87e2-847c9f564d1b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-55668 is fixed in version 9.0.13-tuxcare.2 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-55752", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.13-tuxcare.2" } ], "bom-ref": "urn:uuid:85be9f53-3b73-508c-8b3b-3771494add4c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-55752 is fixed in version 9.0.13-tuxcare.2 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-55754", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.13-tuxcare.2" } ], "bom-ref": "urn:uuid:58a0eb04-94cd-5a5a-bc93-8775f1550f83", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55754 affects version 9.0.13-tuxcare.2 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-61795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.13-tuxcare.2" } ], "bom-ref": "urn:uuid:41386295-5cd0-5eed-818d-89e62fb6a2bf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-61795 is fixed in version 9.0.13-tuxcare.2 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-25854", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.13-tuxcare.2" } ], "bom-ref": "urn:uuid:b9606a9e-1e47-5848-9300-b71d0097a523", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25854 is fixed in version 9.0.13-tuxcare.2 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-34483", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.13-tuxcare.2" } ], "bom-ref": "urn:uuid:e7cd10dd-429b-5ec2-9d21-ca5285ea8540", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34483 affects version 9.0.13-tuxcare.2 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-41284", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.13-tuxcare.2" } ], "bom-ref": "urn:uuid:e108d151-80f2-53f1-b245-a49815092614", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41284 affects version 9.0.13-tuxcare.2 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-42498", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.13-tuxcare.2" } ], "bom-ref": "urn:uuid:ca3390b5-7db3-5205-8825-848760b4d89c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42498 affects version 9.0.13-tuxcare.2 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-43512", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.13-tuxcare.2" } ], "bom-ref": "urn:uuid:2bebd9d3-e2cd-57f2-8576-29ff8c40c49a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43512 affects version 9.0.13-tuxcare.2 of org.apache.tomcat:tomcat-catalina, and is fixed in 9.0.13-tuxcare.5." } }, { "id": "CVE-2026-43513", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.13-tuxcare.2" } ], "bom-ref": "urn:uuid:6d91287b-9df7-5ec8-a358-b2c5509dc766", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43513 affects version 9.0.13-tuxcare.2 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-43514", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.13-tuxcare.2" } ], "bom-ref": "urn:uuid:95421233-3961-5494-a356-c3eeecf67bbc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43514 affects version 9.0.13-tuxcare.2 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-43515", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.13-tuxcare.2" } ], "bom-ref": "urn:uuid:7e0de1cc-ab93-5cdb-8a1a-087aaf8b29c8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43515 affects version 9.0.13-tuxcare.2 of org.apache.tomcat:tomcat-catalina, and is fixed in 9.0.13-tuxcare.5." } }, { "id": "CVE-2026-53404", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.13-tuxcare.2" } ], "bom-ref": "urn:uuid:4033cc35-5031-5bbd-ab44-52e445a3eb45", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53404 affects version 9.0.13-tuxcare.2 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-55956", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.13-tuxcare.2" } ], "bom-ref": "urn:uuid:78f2b4ef-b2ab-510d-bbaa-c97e537581f2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-55956 affects version 9.0.13-tuxcare.2 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-55957", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.13-tuxcare.2" } ], "bom-ref": "urn:uuid:6f7e32a2-809f-5502-9990-558b76896418", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-55957 affects version 9.0.13-tuxcare.2 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-65182", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.13-tuxcare.2" } ], "bom-ref": "urn:uuid:1269eb07-cc39-5d91-8341-d9a7e858c432", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65182 affects version 9.0.13-tuxcare.2 of org.apache.tomcat:tomcat-catalina, and is fixed in 9.0.13-tuxcare.7." } }, { "id": "CVE-2026-65905", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.13-tuxcare.2" } ], "bom-ref": "urn:uuid:94322198-3793-5019-945c-6c6f0191f316", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65905 affects version 9.0.13-tuxcare.2 of org.apache.tomcat:tomcat-catalina, and is fixed in 9.0.13-tuxcare.4." } }, { "id": "CVE-2026-68525", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.13-tuxcare.2" } ], "bom-ref": "urn:uuid:64914e78-ebb2-5aff-98a8-221ad14520b0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-68525 affects version 9.0.13-tuxcare.2 of org.apache.tomcat:tomcat-catalina." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.13-tuxcare.2" } ] }