{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:55d1991c-27cf-5b10-8af6-6e33e071a084", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat-catalina", "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.46-tuxcare.14", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.46-tuxcare.14", "version": "9.0.46-tuxcare.14", "pedigree": { "ancestors": [ { "name": "tomcat-catalina", "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.46", "type": "library", "group": "org.apache.tomcat", "version": "9.0.46" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-5388", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.46-tuxcare.14" } ], "bom-ref": "urn:uuid:0e891193-94c6-59c3-a0a2-d244ea6d07ee", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-5388 does not affect version 9.0.46-tuxcare.14 of org.apache.tomcat:tomcat-catalina. Apache Tomcat 9.0.46 is not affected by CVE-2016-5388 (httpoxy). The httpoxy mitigation was already present in the upstream release when TuxCare onboarded version 9.0.46. The CGIServlet contains the envHttpHeadersPattern whitelist filter (added by upstream commit fb3569fbb9a on 2016-08-19) that prevents the \"Proxy\" HTTP header from being converted to the HTTP_PROXY environment variable, blocking the attack vector described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.0.0, < 7.0.72; >= 8.0.0, < 8.5.5), NVD (>= 6.0, <= 6.0.45; >= 7.0, <= 7.0.70; >= 8.0, <= 8.5.4), Snyk (>= 7.35, < 8.5.5; >= 7.35, < 8.5.5).", "justification": "code_not_present" } }, { "id": "CVE-2016-8735", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.46-tuxcare.14" } ], "bom-ref": "urn:uuid:8abaad75-d855-5b0c-b425-c0d03b268688", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-8735 does not affect version 9.0.46-tuxcare.14 of org.apache.tomcat:tomcat-catalina. CVE-2016-8735 affects JmxRemoteLifecycleListener due to missing credential type restrictions, allowing arbitrary Java object deserialization leading to remote code execution. The target Tomcat 9.0.46 contains the complete fix from upstream Apache commit 0e83ad3e54 (Nov 2, 2016): credential type restriction limiting to String/String[] classes (lines 393-395) and server.toStub() usage (line 449). This fix was included in the upstream 9.0.46 release that TuxCare onboarded. Verdict: not_affected with upstream attribution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 6.0.48; >= 7.0.0, < 7.0.73; >= 8.0.0, < 8.0.39; >= 8.5.0, < 8.5.7; >= 9.0.0.M1, < 9.0.0.M12), NVD (< 6.0.48; >= 7.0.0, < 7.0.73; >= 8.0, < 8.0.39; >= 8.5.0, < 8.5.7; = 9.0.0; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (< 6.0.48; >= 7, < 7.0.73; >= 8, < 8.0.39; >= 8.5, < 8.5.7; >= 9, < 9.0.0.M12).", "justification": "code_not_present" } }, { "id": "CVE-2017-12616", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.46-tuxcare.14" } ], "bom-ref": "urn:uuid:85e00dcc-e3cb-567b-ac95-0f0a646788cf", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-12616 does not affect version 9.0.46-tuxcare.14 of org.apache.tomcat:tomcat-catalina. CVE-2017-12616 affects FileDirContext and VirtualDirContext classes in Tomcat 7.0.0-7.0.80, allowing directory traversal to access files outside the web application's document base via specially-crafted paths lacking canonical path validation. The target Tomcat 9.0.46 does NOT contain these vulnerable classes. Tomcat 9.x replaced the legacy DirContext API with the WebResources API (AbstractFileResourceSet, DirResourceSet, etc.) during its architectural redesign. The WebResources API includes canonical path validation that prevents directory traversal, implemented in AbstractFileResourceSet.file() method lines 92-100 since the initial October 2012 merge by upstream developer Mark Thomas. This protection predates CVE-2017-12616 by 5 years and was already present in the Tomcat 9.0.46 upstream release (tagged May 2021) that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.0.0, < 7.0.81), NVD (= 7.0.0; = 7.0.0-beta; = 7.0.1; = 7.0.2; = 7.0.2-beta; = 7.0.3; = 7.0.4; = 7.0.4-beta; = 7.0.5; = 7.0.5-beta; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 7.0.76; = 7.0.77; = 7.0.79; = 7.0.80), cve.org (>= 7.0.0, <= 7.0.80), Snyk (>= 7.0.0, < 7.0.81).", "justification": "code_not_present" } }, { "id": "CVE-2017-12617", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.46-tuxcare.14" } ], "bom-ref": "urn:uuid:7285f12b-f183-59be-910b-d786683dcc5e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-12617 does not affect version 9.0.46-tuxcare.14 of org.apache.tomcat:tomcat-catalina. CVE-2017-12617 is NOT present in Tomcat 9.0.46. The vulnerability allowed uploading JSP files via HTTP PUT requests with paths ending in trailing slashes (e.g., \"file.jsp/\"). The upstream Apache Tomcat project fixed this vulnerability in commits b577f9a7996 and b7e0435d17 (both by Mark Thomas, September 2017), which were already included in the upstream 9.0.46 release before TuxCare onboarded it. Both required defenses are present: AbstractFileResourceSet.file() rejects file lookups when paths end in '/', and DirResourceSet.write() blocks file writes when paths end in '/'. The CVE affected versions 9.0.0.M1 to 9.0.0, but version 9.0.46 is well beyond that range and contains the upstream fixes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82; >= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82), NVD (>= 7.0.0, < 7.0.82; >= 8.0, < 8.0.47; >= 8.5.0, < 8.5.23; >= 9.0.0, < 9.0.1), cve.org (>= 9.0.0.M1, <= 9.0.0; >= 8.5.0, <= 8.5.22; >= 8.0.0.RC1, <= 8.0.46; >= 7.0.0, <= 7.0.81), Snyk (< 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1).", "justification": "code_not_present" } }, { "id": "CVE-2017-5648", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.46-tuxcare.14" } ], "bom-ref": "urn:uuid:c5ec0de5-8e33-5701-9db8-fd51ab587bb3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-5648 does not affect version 9.0.46-tuxcare.14 of org.apache.tomcat:tomcat-catalina. CVE-2017-5648 is not present in Apache Tomcat 9.0.46. The vulnerability involved application listeners receiving raw internal Request/Response objects instead of facade wrappers, allowing untrusted applications under SecurityManager to retain references and access data from other web applications. The upstream Apache fix (commit dfa40863 by Mark Thomas) was already included in the Tomcat 9.0.46 release that TuxCare onboarded. All affected files (AsyncContextImpl.java, StandardHostValve.java, FormAuthenticator.java) correctly use request.getRequest() to obtain facade wrappers before passing to fireRequestInitEvent() and fireRequestDestroyEvent() methods.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76; >= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76), NVD (= 7.0.0; = 7.0.1; = 7.0.2; = 7.0.3; = 7.0.4; = 7.0.5; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.52; = 7.0.53; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 8.0.0; = 8.0.0-rc1; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.8; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M17; >= 8.5.0, <= 8.5.11; >= 8.0.0.RC1, <= 8.0.41; >= 7.0.0, <= 7.0.75), Snyk (>= 7.0.0, < 7.0.76; >= 8, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9-alpha, < 9.0.0.M17; >= 7.0.0, < 7.0.76; >= 8.0.0-RC1, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9.0.0.M1, < 9.0.0.M17).", "justification": "code_not_present" } }, { "id": "CVE-2019-0221", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.46-tuxcare.14" } ], "bom-ref": "urn:uuid:78dc925c-082b-5c3c-94c9-c7c7676bf004", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-0221 does not affect version 9.0.46-tuxcare.14 of org.apache.tomcat:tomcat-catalina. not_affected \u2014 The target repository (Apache Tomcat 9.0.46) is NOT AFFECTED by CVE-2019-0221. The vulnerability (XSS in SSI printenv command due to unescaped output) was fixed by upstream Apache in March 2019 (commit 15fcd166ea) before TuxCare began maintaining this version. The fix applies HTML entity encoding to variable values via SSIMediator.ENCODING_ENTITY, preventing script execution. The vulnerable cod...", "justification": "code_not_present" } }, { "id": "CVE-2020-9484", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.46-tuxcare.14" } ], "bom-ref": "urn:uuid:8d5f7e34-88d2-55a6-b107-b8e9c096906b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-9484 does not affect version 9.0.46-tuxcare.14 of org.apache.tomcat:tomcat-catalina. Fix already present in baseline since 9.0.35. Verified in java/org/apache/catalina/session/FileStore.java:303 \u2014 canonicalFile.toPath().startsWith(storageDir.getCanonicalFile().toPath()) containment check is in place. Advisory range 9.0.0.M1-9.0.34; 9.0.90 is well past the fix.", "justification": "code_not_present" } }, { "id": "CVE-2022-45143", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.46-tuxcare.14" } ], "bom-ref": "urn:uuid:2855fb11-4c8c-59eb-8e9d-c1c620d0211e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-45143 is fixed in version 9.0.46-tuxcare.14 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2023-24998", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.46-tuxcare.14" } ], "bom-ref": "urn:uuid:96f61b60-e647-5c18-bef7-5e7ddee1a602", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-24998 is fixed in version 9.0.46-tuxcare.14 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2023-28708", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.46-tuxcare.14" } ], "bom-ref": "urn:uuid:df5ba098-d542-535f-b225-919cc142319a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-28708 is fixed in version 9.0.46-tuxcare.14 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2023-41080", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.46-tuxcare.14" } ], "bom-ref": "urn:uuid:699aa62a-4e0e-507d-bf14-806ace6c16d8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-41080 is fixed in version 9.0.46-tuxcare.14 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2023-42795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.46-tuxcare.14" } ], "bom-ref": "urn:uuid:77b0f1db-54e2-535e-ad9b-70a62a951195", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-42795 is fixed in version 9.0.46-tuxcare.14 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2023-46589", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.46-tuxcare.14" } ], "bom-ref": "urn:uuid:a0975072-a092-5e83-b5b8-0928b9af9d77", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-46589 is fixed in version 9.0.46-tuxcare.14 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2024-50379", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.46-tuxcare.14" } ], "bom-ref": "urn:uuid:a54ec22f-5b93-5f22-aeca-f45a074891b8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-50379 is fixed in version 9.0.46-tuxcare.14 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2024-52316", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.46-tuxcare.14" } ], "bom-ref": "urn:uuid:202390df-bcd0-5e9c-a9d8-e2b827da9926", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-52316 is fixed in version 9.0.46-tuxcare.14 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2024-56337", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.46-tuxcare.14" } ], "bom-ref": "urn:uuid:0e4bf82b-9ac5-56ff-894b-458302005b1d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-56337 is fixed in version 9.0.46-tuxcare.14 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-24813", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.46-tuxcare.14" } ], "bom-ref": "urn:uuid:ef0188ab-a105-51fe-be54-3232af9f31fe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-24813 is fixed in version 9.0.46-tuxcare.14 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-31651", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.46-tuxcare.14" } ], "bom-ref": "urn:uuid:c759f45f-8385-5498-8ff7-b2fbb12ededd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-31651 is fixed in version 9.0.46-tuxcare.14 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-46701", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.46-tuxcare.14" } ], "bom-ref": "urn:uuid:1d77e354-0d38-58f3-b9c7-57cf60c33e61", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-46701 is fixed in version 9.0.46-tuxcare.14 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-48988", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.46-tuxcare.14" } ], "bom-ref": "urn:uuid:0a3b8cd1-6114-55ec-a50f-72a009b80413", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48988 is fixed in version 9.0.46-tuxcare.14 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-49124", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.46-tuxcare.14" } ], "bom-ref": "urn:uuid:811ce102-98c0-5488-a15c-1853e387ec4c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-49124 is fixed in version 9.0.46-tuxcare.14 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-49125", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.46-tuxcare.14" } ], "bom-ref": "urn:uuid:285d17b0-b687-50da-af21-1118ffee211b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-49125 is fixed in version 9.0.46-tuxcare.14 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-52520", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.46-tuxcare.14" } ], "bom-ref": "urn:uuid:655d9d01-f4f1-5251-86eb-94421e2256c4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-52520 is fixed in version 9.0.46-tuxcare.14 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-55668", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.46-tuxcare.14" } ], "bom-ref": "urn:uuid:be774bce-d4cd-5fa0-965f-4580c16471d4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-55668 is fixed in version 9.0.46-tuxcare.14 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-55752", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.46-tuxcare.14" } ], "bom-ref": "urn:uuid:418be2b7-fbf7-5a1e-b81a-55be5ffc0910", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-55752 is fixed in version 9.0.46-tuxcare.14 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-55754", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.46-tuxcare.14" } ], "bom-ref": "urn:uuid:a0f8e48d-b330-572e-92b3-e923e24a12a7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-55754 is fixed in version 9.0.46-tuxcare.14 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-61795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.46-tuxcare.14" } ], "bom-ref": "urn:uuid:5317b947-2b57-5fe0-8261-3020dad73992", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-61795 is fixed in version 9.0.46-tuxcare.14 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-25854", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.46-tuxcare.14" } ], "bom-ref": "urn:uuid:c32a7e38-6f90-5663-b25e-f0b6cc27c200", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25854 is fixed in version 9.0.46-tuxcare.14 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-34483", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.46-tuxcare.14" } ], "bom-ref": "urn:uuid:34acad9b-0213-5ccf-a13a-afc14134e8da", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-34483 does not affect version 9.0.46-tuxcare.14 of org.apache.tomcat:tomcat-catalina. Version 9.0.46 is not vulnerable. Summary: CVE-2026-34483 does NOT affect Tomcat 9.0.46. The vulnerable component JsonAccessLogValve was introduced in version 9.0.74 (April 2023), almost 2 years after version 9.0.46 was released (May 2021). The target version predates the introduction of the vulnerable feature. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "code_not_present" } }, { "id": "CVE-2026-41284", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.46-tuxcare.14" } ], "bom-ref": "urn:uuid:826c3fa1-f6fa-54eb-a5d9-83a8cec954e5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41284 affects version 9.0.46-tuxcare.14 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-42498", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.46-tuxcare.14" } ], "bom-ref": "urn:uuid:500dacc1-0274-56f9-9144-a1b0015b30a6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42498 affects version 9.0.46-tuxcare.14 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-43512", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.46-tuxcare.14" } ], "bom-ref": "urn:uuid:b98ea8dc-3149-5604-aa9b-7fc19f7cff4d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-43512 is fixed in version 9.0.46-tuxcare.14 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-43513", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.46-tuxcare.14" } ], "bom-ref": "urn:uuid:c8069373-1630-5a9d-b976-8131246b6c30", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43513 affects version 9.0.46-tuxcare.14 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-43514", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.46-tuxcare.14" } ], "bom-ref": "urn:uuid:447bd50b-c2e2-593d-980b-c518e0d4e767", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43514 affects version 9.0.46-tuxcare.14 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-43515", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.46-tuxcare.14" } ], "bom-ref": "urn:uuid:bca55cc8-b567-5b15-98d1-3fe2d0ab7c24", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-43515 is fixed in version 9.0.46-tuxcare.14 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-53404", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.46-tuxcare.14" } ], "bom-ref": "urn:uuid:503ecbbe-b3e3-5019-8ade-952add0f5695", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53404 affects version 9.0.46-tuxcare.14 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-55956", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.46-tuxcare.14" } ], "bom-ref": "urn:uuid:63fe8f9d-e04a-5c54-b1ec-c0b1692883d0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-55956 affects version 9.0.46-tuxcare.14 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-55957", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.46-tuxcare.14" } ], "bom-ref": "urn:uuid:dc8e75b8-b7c6-5b98-83ec-c4442500f7f2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-55957 affects version 9.0.46-tuxcare.14 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-65182", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.46-tuxcare.14" } ], "bom-ref": "urn:uuid:a1714341-9bfa-5e46-b74b-2bfb4377bf9f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65182 affects version 9.0.46-tuxcare.14 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-65905", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.46-tuxcare.14" } ], "bom-ref": "urn:uuid:b9411ef3-7e3e-52e4-bf83-5e0c5bbe255a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65905 is fixed in version 9.0.46-tuxcare.14 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-68525", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.46-tuxcare.14" } ], "bom-ref": "urn:uuid:7a6c4c66-0e26-554c-a24e-1b11058d0a1e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-68525 affects version 9.0.46-tuxcare.14 of org.apache.tomcat:tomcat-catalina." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.46-tuxcare.14" } ] }