{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:bfd4fdd9-d4e3-5528-b1d9-eedffb78d9b7", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat-catalina", "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.24-tuxcare.1", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.24-tuxcare.1", "version": "9.0.24-tuxcare.1", "pedigree": { "ancestors": [ { "name": "tomcat-catalina", "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.24", "type": "library", "group": "org.apache.tomcat", "version": "9.0.24" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-5388", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:2f019f34-3914-571d-81be-6683cf47b8e1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-5388 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina. The target Tomcat 9.0.24 is not affected by CVE-2016-5388 (httpoxy). The httpoxy mitigation was added by Apache upstream in commit fb3569fbb9 (2016-08-19) by Mark Thomas, which introduced the envHttpHeaders whitelist filter. This fix was included in the upstream 9.0.24 release that TuxCare onboarded. The CGI servlet now only passes whitelisted HTTP headers (ACCEPT*, CACHE-CONTROL, COOKIE, HOST, IF-*, REFERER, USER-AGENT) to CGI environment variables, blocking the Proxy header from being set as HTTP_PROXY. The vulnerable code pattern is not present because the upstream vendor fixed it before the 9.0.24 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.0.0, < 7.0.72; >= 8.0.0, < 8.5.5), NVD (>= 6.0, <= 6.0.45; >= 7.0, <= 7.0.70; >= 8.0, <= 8.5.4), Snyk (>= 7.35, < 8.5.5; >= 7.35, < 8.5.5).", "justification": "code_not_present" } }, { "id": "CVE-2016-8735", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:00086aa8-25b1-5514-a0a3-9a2f0708126a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-8735 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina. CVE-2016-8735 is not present in Tomcat 9.0.24. The vulnerability allowed remote code execution via malicious credential object deserialization in JmxRemoteLifecycleListener. The fix, which restricts credential types to String[] and String only, was included in upstream Tomcat 9.0.0.M12 (Nov 2016) and is present in the target version 9.0.24. The fix commit (0e83ad3e547) by Mark Thomas was part of the upstream release that TuxCare onboarded, making this an upstream-fixed version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 6.0.48; >= 7.0.0, < 7.0.73; >= 8.0.0, < 8.0.39; >= 8.5.0, < 8.5.7; >= 9.0.0.M1, < 9.0.0.M12), NVD (< 6.0.48; >= 7.0.0, < 7.0.73; >= 8.0, < 8.0.39; >= 8.5.0, < 8.5.7; = 9.0.0; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (< 6.0.48; >= 7, < 7.0.73; >= 8, < 8.0.39; >= 8.5, < 8.5.7; >= 9, < 9.0.0.M12).", "justification": "code_not_present" } }, { "id": "CVE-2017-12616", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:47b621a7-3d31-5eaa-877c-1c4988f05254", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-12616 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina. Tomcat 9.0.24 is not affected by CVE-2017-12616. The vulnerable classes VirtualDirContext and FileDirContext, which existed in Tomcat 7.0.0-7.0.80, do not exist in Tomcat 9.x. They were replaced by the WebResourceRoot/WebResourceSet architecture starting in Tomcat 8.0 (October 2012). The replacement architecture includes the mustExist parameter defense from its initial implementation, preventing the vulnerability pattern (accessing File objects for non-existent/unreadable files during read operations) from ever existing in Tomcat 9.x.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.0.0, < 7.0.81), NVD (= 7.0.0; = 7.0.0-beta; = 7.0.1; = 7.0.2; = 7.0.2-beta; = 7.0.3; = 7.0.4; = 7.0.4-beta; = 7.0.5; = 7.0.5-beta; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 7.0.76; = 7.0.77; = 7.0.79; = 7.0.80), cve.org (>= 7.0.0, <= 7.0.80), Snyk (>= 7.0.0, < 7.0.81).", "justification": "code_not_present" } }, { "id": "CVE-2017-12617", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:3eea1e7a-cb46-551b-8afe-9d1af0ef56e7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-12617 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina. CVE-2017-12617 is not present in Apache Tomcat 9.0.24. The vulnerability allowed uploading JSP files via HTTP PUT with paths ending in '/', exploiting a discrepancy between Java's File API (which matches files ignoring trailing slashes) and servlet spec path mapping rules (which treat trailing slashes as directories). The comprehensive fix was authored by Apache upstream developer Mark Thomas (markt@apache.org) and was already present in the 9.0.24 release that TuxCare onboarded. The fix prevents both file creation and file lookup operations when paths end with '/'.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82; >= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82), NVD (>= 7.0.0, < 7.0.82; >= 8.0, < 8.0.47; >= 8.5.0, < 8.5.23; >= 9.0.0, < 9.0.1), cve.org (>= 9.0.0.M1, <= 9.0.0; >= 8.5.0, <= 8.5.22; >= 8.0.0.RC1, <= 8.0.46; >= 7.0.0, <= 7.0.81), Snyk (< 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1).", "justification": "code_not_present" } }, { "id": "CVE-2017-5648", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:61b4d33d-d56f-558f-8bd6-751e5b2f84f1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-5648 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina. CVE-2017-5648 is NOT present in Apache Tomcat 9.0.24. The vulnerability involved passing Tomcat's internal Request/Response objects (instead of facade objects) to application listener events (fireRequestInitEvent/fireRequestDestroyEvent), allowing untrusted applications under SecurityManager to retain references and access data from other web applications. The upstream fix by Mark Thomas (March 2017) changed all vulnerable call sites to use request.getRequest() before passing to listeners. This fix was already included in Apache Tomcat 9.0.24 (released July 2019) when TuxCare onboarded it. All three affected files (FormAuthenticator, AsyncContextImpl, StandardHostValve) use the corrected facade pattern in the target code at HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76; >= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76), NVD (= 7.0.0; = 7.0.1; = 7.0.2; = 7.0.3; = 7.0.4; = 7.0.5; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.52; = 7.0.53; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 8.0.0; = 8.0.0-rc1; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.8; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M17; >= 8.5.0, <= 8.5.11; >= 8.0.0.RC1, <= 8.0.41; >= 7.0.0, <= 7.0.75), Snyk (>= 7.0.0, < 7.0.76; >= 8, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9-alpha, < 9.0.0.M17; >= 7.0.0, < 7.0.76; >= 8.0.0-RC1, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9.0.0.M1, < 9.0.0.M17).", "justification": "code_not_present" } }, { "id": "CVE-2019-0221", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:9e10267a-de55-5b15-860b-3297e42d3def", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-0221 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina. not_affected \u2014 CVE-2019-0221 affects Apache Tomcat's SSI printenv command which echoes user-provided data without escaping, leading to XSS. The target Tomcat 9.0.24 is NOT affected because the upstream fix (commit 15fcd166ea by markt@apache.org, applied 2019-03-11) was already included in the 9.0.24 release before TuxCare onboarded it. The fix applies HTML entity encoding to variable values via SSIMediator.EN...", "justification": "code_not_present" } }, { "id": "CVE-2020-9484", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:1f6b89c0-7b43-5c4c-b63b-770c99c4e0ec", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-9484 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2022-45143", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:079ca10f-1e57-5b86-b236-939bdcf5ce83", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-45143 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina. Apache Tomcat 9.0.24 is not affected by CVE-2022-45143. The vulnerability concerns JsonErrorReportValve, a component that does not exist in version 9.0.24. JsonErrorReportValve was introduced in Tomcat 9.0.40. Version 9.0.24 only contains ErrorReportValve, which produces HTML error pages and properly escapes user-controlled data using Escape.htmlElementContent(). The CVE's stated affected range (9.0.40 to 9.0.68) accurately reflects when the vulnerable component was introduced.", "justification": "code_not_present" } }, { "id": "CVE-2023-24998", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:1432a36a-82ee-5293-b401-a50c53389193", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-24998 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2023-28708", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:824a008e-3315-5370-a9bd-4acbda1fd636", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-28708 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2023-41080", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:b8d0fb39-b9e2-5c9c-b33d-23f1276b1ba1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-41080 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2023-42795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:cb05bfc4-9307-5712-beae-ca341889f74a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-42795 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2023-46589", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:7919c589-025f-5043-8c7a-bb7bc40d7a68", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-46589 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2024-50379", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:2584bd42-f4da-52f9-80bc-813d93c83b4b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-50379 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2024-52316", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:6b547147-a7f8-51ec-b230-836365e203d9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-52316 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2024-56337", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:90911fc1-60a0-521d-af30-3f1a0e9bf0ca", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-56337 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-24813", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:61f14727-727f-5063-bd6f-787f7de0f891", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-24813 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-31651", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:98f5ac85-6cff-547c-bbf5-e06ef90ad859", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31651 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-46701", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:b8766e36-8327-5ae2-9aa7-7415665d72ae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-46701 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-48988", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:f7810c36-35e5-57d4-a116-e64ed1bc4541", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48988 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-49124", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:d0b893ee-20ce-59c6-87cb-0565311fa8c8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-49124 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-49125", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:8719c8c0-8cea-5d51-8a35-664c423dae39", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-49125 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-52520", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:d154f2e2-f9f1-5185-8fb8-69c338e482d8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-52520 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-55668", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:5ad7d690-852d-59c6-8c0c-caf8a5c923ca", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-55668 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-55752", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:63813e1a-e555-5cd8-a4e4-32b85678cd7e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-55752 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-55754", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:89912b53-a393-527a-adb4-1d7d92ba1709", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55754 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-61795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:0ad466c4-b876-5904-84b6-476c2914c0f2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-61795 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-25854", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:1a61ce97-e4d2-5cd4-8379-99a115481962", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25854 is fixed in version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-34483", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:95c82ab2-1b50-5164-8a75-a0419e504099", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-34483 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the vulnerable JsonAccessLogValve component is absent. The default configuration uses AccessLogValve with a plain-text log pattern (conf/server.xml:164), and its output is written directly to a file (java/org/apache/catalina/valves/AccessLogValve.java:615). The only JSON reference in the valves implementation sets an HTTP response content type, providing no JSON access-log path (java/org/apache/catalina/valves/HealthCheckValve.java:57).", "justification": "code_not_present" } }, { "id": "CVE-2026-41284", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:58ee5133-6029-5d40-b3ad-9b626ca7ca2b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41284 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-42498", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:ba739707-ed8d-50f4-b1de-465cd8b822f5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42498 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-43512", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:a36c5f29-3cc6-524e-bbea-4349504ee287", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43512 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-43513", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:efc21dd2-c133-5777-b5ed-ddf37f15d049", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43513 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-43514", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:b978aea6-2749-5e10-9b30-48215d191ec0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43514 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-43515", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:d1a02636-6099-5067-a34d-aaa574172a11", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43515 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-53404", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:175fc8fc-d02a-5cc1-bcea-e6d4c7de0adc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53404 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-55956", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:06821fa5-0e05-5cf2-aa14-010278d174ee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-55956 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-55957", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:acfb215c-6db9-5b57-9baf-f7c7cdcb7acf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-55957 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-65182", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:de96ef4c-7ec7-5c48-ade6-aaff47b552e0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65182 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-65905", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:fec1e14a-6c24-5daf-9ca6-bf2d47b9482d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65905 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-68525", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.24-tuxcare.1" } ], "bom-ref": "urn:uuid:3c1ed1fd-3c8c-56f0-bb29-b93caeb5ad46", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-68525 affects version 9.0.24-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.24-tuxcare.1" } ] }