{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:449e17da-42e0-595a-9631-2315e377e3a5", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat-catalina", "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.39-tuxcare.1", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.39-tuxcare.1", "version": "9.0.39-tuxcare.1", "pedigree": { "ancestors": [ { "name": "tomcat-catalina", "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.39", "type": "library", "group": "org.apache.tomcat", "version": "9.0.39" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-5388", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.39-tuxcare.1" } ], "bom-ref": "urn:uuid:eea6cf45-dcf3-5dad-a0b5-f979d16812c5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-5388 does not affect version 9.0.39-tuxcare.1 of org.apache.tomcat:tomcat-catalina. CVE-2016-5388 (httpoxy) is NOT present in Tomcat 9.0.39. The vulnerability allowed attackers to inject a \"Proxy\" HTTP header that would be passed to CGI scripts as the HTTP_PROXY environment variable, redirecting outbound HTTP traffic. The upstream Apache Tomcat fix (commit fb3569fbb9 by Mark Thomas) was already present in the 9.0.39 release that TuxCare onboarded. The fix replaces a blacklist approach with a whitelist regex pattern that only allows specific safe headers to be passed to the CGI environment, excluding \"Proxy\". The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.0.0, < 7.0.72; >= 8.0.0, < 8.5.5), NVD (>= 6.0, <= 6.0.45; >= 7.0, <= 7.0.70; >= 8.0, <= 8.5.4), Snyk (>= 7.35, < 8.5.5; >= 7.35, < 8.5.5).", "justification": "code_not_present" } }, { "id": "CVE-2016-8735", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.39-tuxcare.1" } ], "bom-ref": "urn:uuid:d83f0440-2f03-500e-be21-35f2235a7e4b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-8735 does not affect version 9.0.39-tuxcare.1 of org.apache.tomcat:tomcat-catalina. CVE-2016-8735 affects Tomcat 9.x before 9.0.0.M12. The target version 9.0.39 is much newer and already contains the upstream fix that restricts JMX remote credential types to String[] and String only, preventing deserialization attacks. The fix (commit 0e83ad3e54) was authored by Apache committer Mark Thomas and was already present in the upstream Tomcat 9.0.39 release that TuxCare onboarded. The vulnerable pattern is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 6.0.48; >= 7.0.0, < 7.0.73; >= 8.0.0, < 8.0.39; >= 8.5.0, < 8.5.7; >= 9.0.0.M1, < 9.0.0.M12), NVD (< 6.0.48; >= 7.0.0, < 7.0.73; >= 8.0, < 8.0.39; >= 8.5.0, < 8.5.7; = 9.0.0; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (< 6.0.48; >= 7, < 7.0.73; >= 8, < 8.0.39; >= 8.5, < 8.5.7; >= 9, < 9.0.0.M12).", "justification": "code_not_present" } }, { "id": "CVE-2017-12616", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.39-tuxcare.1" } ], "bom-ref": "urn:uuid:a3b99732-6f3d-56f0-b21d-9e1b672b76a3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-12616 does not affect version 9.0.39-tuxcare.1 of org.apache.tomcat:tomcat-catalina. CVE-2017-12616 affects VirtualDirContext and FileDirContext classes in Tomcat 7.0.0-7.0.80, which allowed directory traversal via missing canonical path validation. These classes do not exist in Tomcat 9.0.39. They were replaced by the WebResourceRoot architecture in Tomcat 8 (October 2012), which includes built-in canonical path validation from its inception. The vulnerability pattern cannot occur in this version due to the architectural redesign that predates the CVE by 5 years.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.0.0, < 7.0.81), NVD (= 7.0.0; = 7.0.0-beta; = 7.0.1; = 7.0.2; = 7.0.2-beta; = 7.0.3; = 7.0.4; = 7.0.4-beta; = 7.0.5; = 7.0.5-beta; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 7.0.76; = 7.0.77; = 7.0.79; = 7.0.80), cve.org (>= 7.0.0, <= 7.0.80), Snyk (>= 7.0.0, < 7.0.81).", "justification": "code_not_reachable" } }, { "id": "CVE-2017-12617", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.39-tuxcare.1" } ], "bom-ref": "urn:uuid:117ca1eb-f1e2-5fef-8d61-b36e8586c151", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-12617 does not affect version 9.0.39-tuxcare.1 of org.apache.tomcat:tomcat-catalina. CVE-2017-12617 is NOT present in Tomcat 9.0.39. The vulnerability allowed uploading JSP files via specially crafted PUT requests with trailing slashes to bypass file extension validation. The upstream fix (commits b7e0435d17 and b577f9a7996 by Mark Thomas) was already included in the 9.0.39 release that TuxCare onboarded. Both DirResourceSet.write() and AbstractFileResourceSet.file() reject paths ending with \"/\" to prevent the Java File API from dropping the trailing slash and creating files with different names than validated.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82; >= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82), NVD (>= 7.0.0, < 7.0.82; >= 8.0, < 8.0.47; >= 8.5.0, < 8.5.23; >= 9.0.0, < 9.0.1), cve.org (>= 9.0.0.M1, <= 9.0.0; >= 8.5.0, <= 8.5.22; >= 8.0.0.RC1, <= 8.0.46; >= 7.0.0, <= 7.0.81), Snyk (< 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1).", "justification": "code_not_present" } }, { "id": "CVE-2017-5648", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.39-tuxcare.1" } ], "bom-ref": "urn:uuid:230f5551-a24e-5ddf-b50d-4166954bedc7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-5648 does not affect version 9.0.39-tuxcare.1 of org.apache.tomcat:tomcat-catalina. CVE-2017-5648 is NOT present in Apache Tomcat 9.0.39. The vulnerability involved passing internal Tomcat Request/Response objects to application listeners without facade wrapping, allowing untrusted applications under SecurityManager to retain references and access/modify cross-application data. The fix was committed by Mark Thomas (markt@apache.org) on 2017-03-06 in commit dfa40863421d7681fed893b4256666491887e38c, changing fireRequestInitEvent() and fireRequestDestroyEvent() calls to use request.getRequest() facades. This fix was already present in the upstream Apache Tomcat 9.0.39 release that TuxCare onboarded on 2026-09-12. All three affected files (FormAuthenticator.java, StandardHostValve.java, AsyncContextImpl.java) contain the corrected code using facade wrappers.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76; >= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76), NVD (= 7.0.0; = 7.0.1; = 7.0.2; = 7.0.3; = 7.0.4; = 7.0.5; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.52; = 7.0.53; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 8.0.0; = 8.0.0-rc1; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.8; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M17; >= 8.5.0, <= 8.5.11; >= 8.0.0.RC1, <= 8.0.41; >= 7.0.0, <= 7.0.75), Snyk (>= 7.0.0, < 7.0.76; >= 8, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9-alpha, < 9.0.0.M17; >= 7.0.0, < 7.0.76; >= 8.0.0-RC1, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9.0.0.M1, < 9.0.0.M17).", "justification": "code_not_present" } }, { "id": "CVE-2019-0221", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.39-tuxcare.1" } ], "bom-ref": "urn:uuid:f9348add-7fcd-50bc-8041-3c5c14d5880c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-0221 does not affect version 9.0.39-tuxcare.1 of org.apache.tomcat:tomcat-catalina. not_affected \u2014 Target version 9.0.39 is not affected by CVE-2019-0221. The vulnerable code pattern (unescaped output in SSI printenv command) has been removed by upstream Apache Tomcat. The fix was already present in the upstream 9.0.39 release before TuxCare onboarded it. The SSIPrintenv.java file at line 44 shows the fix: getVariableValue() is called with SSIMediator.ENCODING_ENTITY parameter, which perform...", "justification": "code_not_present" } }, { "id": "CVE-2020-9484", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.39-tuxcare.1" } ], "bom-ref": "urn:uuid:5fb5de44-95df-515a-86a2-85a4d6e2ae63", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-9484 does not affect version 9.0.39-tuxcare.1 of org.apache.tomcat:tomcat-catalina. Target is Apache Tomcat 9.0.39 (SHA 6989c4e9). CVE-2020-9484 is a deserialization RCE: an attacker-controlled session id (e.g. a JSESSIONID containing \"../\" sequences) makes org.apache.catalina.session.FileStore construct a path escaping its storage directory and deserialize an attacker-planted file. The vendor fix (Apache commit 3aa8f28db7, \"Improve validation of storage location when using FileStore.\") adds a canonical-path containment check to FileStore.file(). That exact fix is present in 9.0.39: FileStore.java lines 344-360 contain `if (!file.getCanonicalPath().startsWith(storageDir.getCanonicalPath())) { log.warn(\"fileStore.invalid\"...); return null; }`, and LocalStrings.properties:33 defines the fileStore.invalid message. The check is on every execution path to deserialization (load() calls file(id) at line 217 and short-circuits at line 218 before the ObjectInputStream at line 232; remove() and save() also route through file()). CVE lists affected 9.0.0.M1-9.0.34; the fix shipped in 9.0.35, so 9.0.39 is post-fix \u2014 verified by code, not metadata. Fix commit author is markt@apache.org (upstream Apache), not a TuxCare/CloudLinux backport; the only TuxCare backports present target other CVEs on other branches (9.0.24, 10.1.33). Hence not_affected via an upstream-authored fix already in the shipped version (code_not_present).", "justification": "code_not_present" } }, { "id": "CVE-2022-45143", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.39-tuxcare.1" } ], "bom-ref": "urn:uuid:93347f26-0ad3-5a03-93fe-3adf08acadd6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-45143 does not affect version 9.0.39-tuxcare.1 of org.apache.tomcat:tomcat-catalina. Apache Tomcat 9.0.39 is not affected by CVE-2022-45143. The vulnerable component (JsonErrorReportValve) does not exist in this version. JsonErrorReportValve was first introduced in version 9.0.40 (commit 295709303f), which is one version after the target. The CVE's stated affected range (9.0.40 to 9.0.68) correctly excludes 9.0.39. This is a Rule 5 Type A1 case: the component that receives the malicious input is absent from the codebase.", "justification": "code_not_present" } }, { "id": "CVE-2023-24998", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.39-tuxcare.1" } ], "bom-ref": "urn:uuid:d050b03a-aa4b-5307-a8fa-9442c3c00943", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-24998 affects version 9.0.39-tuxcare.1 of org.apache.tomcat:tomcat-catalina, and is fixed in 9.0.39-tuxcare.2." } }, { "id": "CVE-2023-28708", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.39-tuxcare.1" } ], "bom-ref": "urn:uuid:21dbc90b-1173-5504-ab1b-f5240a58d469", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-28708 affects version 9.0.39-tuxcare.1 of org.apache.tomcat:tomcat-catalina, and is fixed in 9.0.39-tuxcare.2." } }, { "id": "CVE-2023-41080", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.39-tuxcare.1" } ], "bom-ref": "urn:uuid:6bfde120-fc88-5c3b-9af5-c5c6486eb2cb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-41080 affects version 9.0.39-tuxcare.1 of org.apache.tomcat:tomcat-catalina, and is fixed in 9.0.39-tuxcare.2." } }, { "id": "CVE-2023-42795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.39-tuxcare.1" } ], "bom-ref": "urn:uuid:078e783d-b4ed-585f-9f4f-0b2ed856490e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-42795 affects version 9.0.39-tuxcare.1 of org.apache.tomcat:tomcat-catalina, and is fixed in 9.0.39-tuxcare.2." } }, { "id": "CVE-2023-46589", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.39-tuxcare.1" } ], "bom-ref": "urn:uuid:137ba34a-77bd-5993-b5d7-d3e38aceb223", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-46589 affects version 9.0.39-tuxcare.1 of org.apache.tomcat:tomcat-catalina, and is fixed in 9.0.39-tuxcare.3." } }, { "id": "CVE-2024-50379", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.39-tuxcare.1" } ], "bom-ref": "urn:uuid:fef9c1e2-4870-5fdf-8e84-a231bf7a157b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-50379 is fixed in version 9.0.39-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2024-52316", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.39-tuxcare.1" } ], "bom-ref": "urn:uuid:73b155c2-85df-5b92-b120-519caeae4370", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-52316 affects version 9.0.39-tuxcare.1 of org.apache.tomcat:tomcat-catalina, and is fixed in 9.0.39-tuxcare.2." } }, { "id": "CVE-2024-56337", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.39-tuxcare.1" } ], "bom-ref": "urn:uuid:980d1066-6f40-5c5b-8029-f56e2f58da53", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-56337 affects version 9.0.39-tuxcare.1 of org.apache.tomcat:tomcat-catalina, and is fixed in 9.0.39-tuxcare.3." } }, { "id": "CVE-2025-24813", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.39-tuxcare.1" } ], "bom-ref": "urn:uuid:7ad00d00-9808-581a-9a9d-bb4963489e22", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-24813 affects version 9.0.39-tuxcare.1 of org.apache.tomcat:tomcat-catalina, and is fixed in 9.0.39-tuxcare.2." } }, { "id": "CVE-2025-31651", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.39-tuxcare.1" } ], "bom-ref": "urn:uuid:84953330-db3f-5f29-b552-c8572a808adb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31651 affects version 9.0.39-tuxcare.1 of org.apache.tomcat:tomcat-catalina, and is fixed in 9.0.39-tuxcare.3." } }, { "id": "CVE-2025-46701", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.39-tuxcare.1" } ], "bom-ref": "urn:uuid:76de6cef-f8c6-5e76-81b5-24e672dcb8d7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-46701 affects version 9.0.39-tuxcare.1 of org.apache.tomcat:tomcat-catalina, and is fixed in 9.0.39-tuxcare.2." } }, { "id": "CVE-2025-48988", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.39-tuxcare.1" } ], "bom-ref": "urn:uuid:eaa681b7-8cab-511c-af51-b2e90cb99045", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-48988 affects version 9.0.39-tuxcare.1 of org.apache.tomcat:tomcat-catalina, and is fixed in 9.0.39-tuxcare.2." } }, { "id": "CVE-2025-49124", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.39-tuxcare.1" } ], "bom-ref": "urn:uuid:b7723232-f078-5894-b2f0-7a3b14b89f48", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49124 affects version 9.0.39-tuxcare.1 of org.apache.tomcat:tomcat-catalina, and is fixed in 9.0.39-tuxcare.2." } }, { "id": "CVE-2025-49125", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.39-tuxcare.1" } ], "bom-ref": "urn:uuid:9d0a67b9-00de-5146-b384-75f147d596ed", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49125 affects version 9.0.39-tuxcare.1 of org.apache.tomcat:tomcat-catalina, and is fixed in 9.0.39-tuxcare.2." } }, { "id": "CVE-2025-52520", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.39-tuxcare.1" } ], "bom-ref": "urn:uuid:a30891cd-854e-57d9-a6a4-785abfd3280b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-52520 affects version 9.0.39-tuxcare.1 of org.apache.tomcat:tomcat-catalina, and is fixed in 9.0.39-tuxcare.2." } }, { "id": "CVE-2025-55668", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.39-tuxcare.1" } ], "bom-ref": "urn:uuid:3620f02a-0e58-517f-8ef3-6d24a4199856", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55668 affects version 9.0.39-tuxcare.1 of org.apache.tomcat:tomcat-catalina, and is fixed in 9.0.39-tuxcare.2." } }, { "id": "CVE-2025-55752", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.39-tuxcare.1" } ], "bom-ref": "urn:uuid:e1e8c989-2d69-531b-86cf-5d8d1c47bcc4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55752 affects version 9.0.39-tuxcare.1 of org.apache.tomcat:tomcat-catalina, and is fixed in 9.0.39-tuxcare.2." } }, { "id": "CVE-2025-55754", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.39-tuxcare.1" } ], "bom-ref": "urn:uuid:2ca5ac47-44b6-534c-9b66-7eefc6fcee19", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55754 affects version 9.0.39-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-61795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.39-tuxcare.1" } ], "bom-ref": "urn:uuid:03311be7-9b9e-58ea-b796-3db3a4e4995f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-61795 affects version 9.0.39-tuxcare.1 of org.apache.tomcat:tomcat-catalina, and is fixed in 9.0.39-tuxcare.2." } }, { "id": "CVE-2026-25854", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.39-tuxcare.1" } ], "bom-ref": "urn:uuid:f4df9bf5-9a47-5263-8dcb-bfe24d1bd283", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-25854 affects version 9.0.39-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-34483", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.39-tuxcare.1" } ], "bom-ref": "urn:uuid:f6bbeb8d-186c-50c4-9de4-953969eafc9b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-34483 does not affect version 9.0.39-tuxcare.1 of org.apache.tomcat:tomcat-catalina. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. The CVE identifies incomplete escaping in `JsonAccessLogValve` (CVE:1). Tracked-tree inspection and repository-wide searches find neither that class nor its JSON wrappers, identifiable in the supplied patch:63. Raw URI/query appends remain at AbstractAccessLogValve.java:1185, 1396 and 1429. Their outputs pass through the element loop to a writer that appends a newline and writes the buffer (AbstractAccessLogValve.java:718, AccessLogValve.java:613). The other built-in access log implementations use W3C format or database statements (ExtendedAccessLogValve.java:44, JDBCAccessLogValve.java:516). The escaping changes are absent, but the affected JSON output component is also absent, leaving the CVE-specific path unreachable.", "justification": "code_not_present" } }, { "id": "CVE-2026-41284", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.39-tuxcare.1" } ], "bom-ref": "urn:uuid:b23f06e0-bb2d-5865-a421-29d72e5aa5a0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41284 affects version 9.0.39-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-42498", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.39-tuxcare.1" } ], "bom-ref": "urn:uuid:716188fd-f596-5d62-86de-26cea038d792", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42498 affects version 9.0.39-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-43512", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.39-tuxcare.1" } ], "bom-ref": "urn:uuid:7ccdfdb9-b73d-5141-95fd-6d607433fd7e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43512 affects version 9.0.39-tuxcare.1 of org.apache.tomcat:tomcat-catalina, and is fixed in 9.0.39-tuxcare.3." } }, { "id": "CVE-2026-43513", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.39-tuxcare.1" } ], "bom-ref": "urn:uuid:f97f115a-df33-572e-8270-f87adf08d392", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43513 affects version 9.0.39-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-43514", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.39-tuxcare.1" } ], "bom-ref": "urn:uuid:6f0b7342-c50e-5f9e-98c8-8d831288ad91", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43514 affects version 9.0.39-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-43515", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.39-tuxcare.1" } ], "bom-ref": "urn:uuid:9d039356-7406-5273-9b2f-fc03c7f0fc1b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43515 affects version 9.0.39-tuxcare.1 of org.apache.tomcat:tomcat-catalina, and is fixed in 9.0.39-tuxcare.3." } }, { "id": "CVE-2026-53404", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.39-tuxcare.1" } ], "bom-ref": "urn:uuid:9b3378c2-7fa9-5b3b-b835-a714d9c63c1f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53404 affects version 9.0.39-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-55956", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.39-tuxcare.1" } ], "bom-ref": "urn:uuid:8becea65-d5e7-5496-9303-341dafc831ac", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-55956 affects version 9.0.39-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-55957", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.39-tuxcare.1" } ], "bom-ref": "urn:uuid:e792d1cf-1014-577f-893a-b0cd52c38fd4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-55957 affects version 9.0.39-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-65182", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.39-tuxcare.1" } ], "bom-ref": "urn:uuid:e2df5fa4-5c0d-572f-821f-9d5fb6b4be21", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65182 affects version 9.0.39-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-65905", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.39-tuxcare.1" } ], "bom-ref": "urn:uuid:1825b70b-8798-5f9f-8527-2f797493df1a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65905 affects version 9.0.39-tuxcare.1 of org.apache.tomcat:tomcat-catalina, and is fixed in 9.0.39-tuxcare.3." } }, { "id": "CVE-2026-68525", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.39-tuxcare.1" } ], "bom-ref": "urn:uuid:e618e73e-6dd2-5aaf-8c9c-f6892c788b2b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-68525 affects version 9.0.39-tuxcare.1 of org.apache.tomcat:tomcat-catalina." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.39-tuxcare.1" } ] }