{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:8a211717-c2fa-504f-9248-250f8f7dea4c", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat-coyote-ffm", "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote-ffm@10.1.55-tuxcare.2", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-coyote-ffm@10.1.55-tuxcare.2", "version": "10.1.55-tuxcare.2", "pedigree": { "ancestors": [ { "name": "tomcat-coyote-ffm", "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote-ffm@10.1.55", "type": "library", "group": "org.apache.tomcat", "version": "10.1.55" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2026-24734", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote-ffm@10.1.55-tuxcare.2" } ], "bom-ref": "urn:uuid:f600e6b0-4395-5996-8d46-007002c6445e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-24734 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-coyote-ffm. Apache Tomcat 10.1.55 is NOT affected by CVE-2026-24734. The vulnerability affects Tomcat versions 10.1.0-M7 through 10.1.51, with the fix introduced in 10.1.52. The target version 10.1.55 already contains the upstream fix (commit e3b562d4cd) that was shipped as part of the Apache Tomcat 10.1.55 release. All required OCSP verification and freshness checks are present in the OpenSSL/Panama FFM implementation, including nonce verification, signature verification, and validity timestamp checks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.18; >= 10.1.0-M7, < 10.1.52; >= 9.0.83, < 9.0.115; >= 11.0.0-M1, < 11.0.18; >= 10.1.0-M7, < 10.1.52; >= 9.0.83, < 9.0.115), NVD (>= 9.0.83, < 9.0.115; >= 10.1.1, < 10.1.52; >= 11.0.1, < 11.0.18; = 10.1.0-milestone1; = 10.1.0-milestone10; = 10.1.0-milestone11; = 10.1.0-milestone12; = 10.1.0-milestone13; = 10.1.0-milestone14; = 10.1.0-milestone15; = 10.1.0-milestone16; = 10.1.0-milestone17; = 10.1.0-milestone18; = 10.1.0-milestone19; = 10.1.0-milestone2; = 10.1.0-milestone20; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8; = 10.1.0-milestone9; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone11; = 11.0.0-milestone12; = 11.0.0-milestone13; = 11.0.0-milestone14; = 11.0.0-milestone15; = 11.0.0-milestone16; = 11.0.0-milestone17; = 11.0.0-milestone18; = 11.0.0-milestone19; = 11.0.0-milestone2; = 11.0.0-milestone20; = 11.0.0-milestone21; = 11.0.0-milestone22; = 11.0.0-milestone23; = 11.0.0-milestone24; = 11.0.0-milestone25; = 11.0.0-milestone26; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9; >= 1.3.0, < 1.3.5; >= 2.0.0, < 2.0.12), cve.org (>= 1.1.23, <= 1.1.34; >= 1.2.0, <= 1.2.39; >= 1.3.0, <= 1.3.4; >= 2.0.0, <= 2.0.11; >= 11.0.0-M1, <= 11.0.17; >= 10.1.0-M7, <= 10.1.51; >= 9.0.83, <= 9.0.114), Snyk (>= 9.0.83, < 9.0.114; >= 10.1.0-M7, < 10.1.52; >= 11.0.0-M1, < 11.0.18; >= 9.0.83, < 9.0.114; >= 10.1.0-M7, < 10.1.52; >= 11.0.0-M1, < 11.0.18).", "justification": "code_not_present" } }, { "id": "CVE-2026-29145", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote-ffm@10.1.55-tuxcare.2" } ], "bom-ref": "urn:uuid:88d9f60c-876a-52a8-9839-2cdd3ec5179c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-29145 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-coyote-ffm. CVE-2026-29145: CLIENT_CERT authentication bypass when OCSP responds with TRY_LATER and soft fail is disabled. The vulnerability is NOT present in Tomcat 10.1.55. The fix was already included in the upstream Apache Tomcat 10.1.55 release (commit fe26667cd2) before TuxCare onboarded this version. The fix ensures OCSP TRY_LATER responses set X509_V_ERR_UNABLE_TO_GET_CRL error, causing authentication to fail when soft fail is disabled.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.83, < 9.0.116; >= 10.1.0-M7, < 10.1.53; >= 11.0.0-M1, < 11.0.20; >= 9.0.83, < 9.0.116; >= 10.1.0-M7, < 10.1.53; >= 11.0.0-M1, < 11.0.20), NVD (>= 9.0.83, < 9.0.116; >= 10.1.1, < 10.1.53; >= 11.0.0, < 11.0.20; = 10.1.0; = 10.1.0-milestone10; = 10.1.0-milestone11; = 10.1.0-milestone12; = 10.1.0-milestone13; = 10.1.0-milestone14; = 10.1.0-milestone15; = 10.1.0-milestone16; = 10.1.0-milestone17; = 10.1.0-milestone18; = 10.1.0-milestone19; = 10.1.0-milestone20; = 10.1.0-milestone7; = 10.1.0-milestone8; = 10.1.0-milestone9; >= 1.1.23, < 1.3.7; >= 2.0.0, < 2.0.14), cve.org (>= 11.0.0-M1, <= 11.0.18; >= 10.1.0-M7, <= 10.1.52; >= 9.0.83, <= 9.0.115; >= 1.1.23, <= 1.1.34; >= 1.2.0, <= 1.2.39; >= 1.3.0, <= 1.3.6; >= 2.0.0, <= 2.0.13), Snyk (>= 10.1.0-M7, < 10.1.26; >= 11.0.0-M1, < 11.0.0-M24; < 9.0.116; >= 10.1.0-M7, < 10.1.53; >= 11.0.0-M1, < 11.0.20; >= 9.0.93, < 9.0.116; >= 10.1.26, < 10.1.53; >= 11.0.0-M24, < 11.0.20).", "justification": "code_not_present" } }, { "id": "CVE-2026-34500", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote-ffm@10.1.55-tuxcare.2" } ], "bom-ref": "urn:uuid:8aa9c7a1-0c1a-5dc3-bcfe-a3f79bb417fc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-34500 does not affect version 10.1.55-tuxcare.2 of org.apache.tomcat:tomcat-coyote-ffm. not_affected \u2014 Apache Tomcat 10.1.55 is not affected by CVE-2026-34500. The vulnerability (CLIENT_CERT authentication not failing as expected when OCSP verification encounters errors and soft-fail is disabled in FFM) was fixed by upstream Apache in commits fe26667cd2, e3b562d4cd, and 29b56a56ce. All three commits were already present in the upstream 10.1.55 release that TuxCare onboarded (commit df13cfd2cc). ...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote-ffm@10.1.55-tuxcare.2" } ] }