{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:5b7b0291-1cd8-5cc7-952f-ac563b9da671", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat-coyote", "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.2", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.2", "version": "9.0.13-tuxcare.2", "pedigree": { "ancestors": [ { "name": "tomcat-coyote", "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13", "type": "library", "group": "org.apache.tomcat", "version": "9.0.13" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-0095", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.2" } ], "bom-ref": "urn:uuid:789b16d5-505b-5c41-a6ac-b9035f4dea7c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0095 does not affect version 9.0.13-tuxcare.2 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 Apache Tomcat 9.0.13 is not affected by CVE-2014-0095. The vulnerability (DoS via Content-Length: 0 AJP requests causing thread hang) was fixed by Apache upstream in March 2014. The fix was already present in the Apache Tomcat 9.0.13 release when TuxCare onboarded it. The current code at AjpProcessor.java:595-609 contains the defense logic that checks for contentLength == 0 and immediately retu...", "justification": "code_not_present" } }, { "id": "CVE-2016-6816", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.2" } ], "bom-ref": "urn:uuid:dbb37599-7f7d-525b-9a18-24b893d75c42", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-6816 does not affect version 9.0.13-tuxcare.2 of org.apache.tomcat:tomcat-coyote. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. The upstream fix was released in 9.0.0.M12, and version 9.0.13 is a later release of the same line. Advisories: GitHub GHSA-jc7p-5r39-9477 (fixed in 9.0.0.M12), NVD (last affected 9.0.0-milestone11), CVE record (last affected 9.0.0.M11), Snyk (fixed in 9.0.0.M13).", "justification": "code_not_present" } }, { "id": "CVE-2017-5651", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.2" } ], "bom-ref": "urn:uuid:1c9e1a1f-428a-5e35-a3c8-03a3b3efba52", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-5651 does not affect version 9.0.13-tuxcare.2 of org.apache.tomcat:tomcat-coyote. Target Apache Tomcat 9.0.13 is NOT AFFECTED by CVE-2017-5651. The upstream fix commit 9233d9d6a018be4415d4d7d6cb4fe01176adf1a8 by Mark Thomas (markt@apache.org) is present on HEAD and was already included in the upstream release 9.0.13 that TuxCare onboarded. The vulnerability pattern (Processor double-caching due to premature sendfileData clearing) does not exist in the target code. All defense mechanisms from the patch are verified present: SendfileState tracking prevents the Processor from being added to cache twice during sendfile operations.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12), Snyk (>= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19).", "justification": "code_not_present" } }, { "id": "CVE-2019-0199", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.2" } ], "bom-ref": "urn:uuid:68579ab7-ebc1-501b-81e0-9c5c9101700b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-0199 affects version 9.0.13-tuxcare.2 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2020-13934", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.2" } ], "bom-ref": "urn:uuid:f9a1a576-bde9-5ded-bee4-e6ba8eba67ef", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-13934 affects version 9.0.13-tuxcare.2 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2020-13943", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.2" } ], "bom-ref": "urn:uuid:97c04a2b-93e7-5438-a65a-ecdaac9fafd1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-13943 affects version 9.0.13-tuxcare.2 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2020-17527", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.2" } ], "bom-ref": "urn:uuid:346e2662-f5ed-5795-955c-612e16ad2ddf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-17527 affects version 9.0.13-tuxcare.2 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2021-25122", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.2" } ], "bom-ref": "urn:uuid:81873207-cbca-50c9-aa52-d6f736ca08f9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-25122 affects version 9.0.13-tuxcare.2 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2022-42252", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.2" } ], "bom-ref": "urn:uuid:38282638-3985-5eb7-8fb1-71a99408b888", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-42252 affects version 9.0.13-tuxcare.2 of org.apache.tomcat:tomcat-coyote, and is fixed in 9.0.13-tuxcare.3." } }, { "id": "CVE-2023-24998", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.2" } ], "bom-ref": "urn:uuid:012d14ad-6644-501b-8848-f9711e4f2cf5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-24998 is fixed in version 9.0.13-tuxcare.2 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-28709", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.2" } ], "bom-ref": "urn:uuid:d00b317d-9d7f-5af2-a3bb-bf86246a8e21", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-28709 affects version 9.0.13-tuxcare.2 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-34981", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.2" } ], "bom-ref": "urn:uuid:a9ab8595-a2f2-5319-adbd-72b6f60b2fd9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-34981 affects version 9.0.13-tuxcare.2 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-42794", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.2" } ], "bom-ref": "urn:uuid:ab48738d-9cf8-5303-87b5-c01e709787d8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-42794 does not affect version 9.0.13-tuxcare.2 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 Target version 9.0.13 is NOT affected by CVE-2023-42794. The vulnerability was introduced by a refactoring in versions 9.0.70-9.0.80 that removed the finalize() method from DiskFileItem.java. Version 9.0.13 predates this refactoring and retains the defensive finalize() method (lines 543-552) that ensures temporary uploaded files are deleted during garbage collection. The vulnerable code pattern...", "justification": "code_not_present" } }, { "id": "CVE-2023-44487", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.2" } ], "bom-ref": "urn:uuid:9f7d9575-c6c5-5ad0-a6a6-3e38bd6cb138", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-44487 is fixed in version 9.0.13-tuxcare.2 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-45648", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.2" } ], "bom-ref": "urn:uuid:6fd04df8-753c-56d4-a1cc-d37555037fd7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-45648 affects version 9.0.13-tuxcare.2 of org.apache.tomcat:tomcat-coyote, and is fixed in 9.0.13-tuxcare.6." } }, { "id": "CVE-2023-46589", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.2" } ], "bom-ref": "urn:uuid:e404a381-1fc5-50d4-8569-0337e3d303b5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-46589 affects version 9.0.13-tuxcare.2 of org.apache.tomcat:tomcat-coyote, and is fixed in 9.0.13-tuxcare.5." } }, { "id": "CVE-2024-21733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.2" } ], "bom-ref": "urn:uuid:cbd50529-9eb8-5f8f-9e90-f4993ff067f2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-21733 affects version 9.0.13-tuxcare.2 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-24549", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.2" } ], "bom-ref": "urn:uuid:d1a9a043-61fb-557d-bf4d-cce5aa4a657b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-24549 is fixed in version 9.0.13-tuxcare.2 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-34750", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.2" } ], "bom-ref": "urn:uuid:33765152-0e0c-5cef-b859-3d1384ddb28f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-34750 affects version 9.0.13-tuxcare.2 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-38286", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.2" } ], "bom-ref": "urn:uuid:5dbb85ad-06bc-51e0-90b2-3d6007b875a6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38286 is fixed in version 9.0.13-tuxcare.2 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-52317", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.2" } ], "bom-ref": "urn:uuid:df220dce-9e3d-5203-b15a-0a4ed43fb931", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-52317 does not affect version 9.0.13-tuxcare.2 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 Apache Tomcat 9.0.13 does not contain the vulnerable request/response recycling mechanism that causes CVE-2024-52317. The vulnerability affects versions 9.0.92-9.0.95 where HTTP/2 request/response object recycling was introduced. Version 9.0.13 creates fresh Request and Response objects for each HTTP/2 stream with no recycling or pooling mechanism, making request/response mix-up impossible.", "justification": "code_not_present" } }, { "id": "CVE-2025-31650", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.2" } ], "bom-ref": "urn:uuid:f7e32cfa-838d-51ba-b3ab-6648758f6392", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-31650 does not affect version 9.0.13-tuxcare.2 of org.apache.tomcat:tomcat-coyote. Apache Tomcat 9.0.13 is not affected by CVE-2025-31650. The vulnerability requires RFC 9218 Extensible Priorities implementation (PRIORITY_UPDATE frames and Priority header parsing via Priority.parsePriority() method), which does not exist in version 9.0.13. The target version only implements the original HTTP/2 PRIORITY frame mechanism (RFC 7540, frame type 2), which is unrelated to this CVE. Exhaustive code analysis confirmed zero RFC 9218-related code present: no PRIORITY_UPDATE frame type, no readPriorityUpdateFrame() method, no Priority.parsePriority() parser class, and no priority header case in Stream.emitHeader(). The CVE's affected version range starts at 9.0.76, where RFC 9218 support was introduced; version 9.0.13 predates this feature.", "justification": "code_not_present" } }, { "id": "CVE-2025-48989", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.2" } ], "bom-ref": "urn:uuid:b09c3c72-f7ea-51f0-bf1d-2ffc7c4d6bf7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48989 is fixed in version 9.0.13-tuxcare.2 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2025-52434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.2" } ], "bom-ref": "urn:uuid:c4404565-0928-52ff-a071-c7ef4bea5e2f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-52434 is fixed in version 9.0.13-tuxcare.2 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2025-53506", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.2" } ], "bom-ref": "urn:uuid:e052c8c0-213a-5285-ac28-decc72cb97bc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-53506 is fixed in version 9.0.13-tuxcare.2 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2025-66614", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.2" } ], "bom-ref": "urn:uuid:8cda6060-693b-5653-98b3-0f5eb381a972", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66614 is fixed in version 9.0.13-tuxcare.2 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-24733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.2" } ], "bom-ref": "urn:uuid:72547aed-b3b3-5c7c-b514-cde47cd006e2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-24733 is fixed in version 9.0.13-tuxcare.2 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-24734", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.2" } ], "bom-ref": "urn:uuid:904b1667-d931-5fa7-b58e-dfeb83cc7f92", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24734 affects version 9.0.13-tuxcare.2 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-24880", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.2" } ], "bom-ref": "urn:uuid:6a4271cc-afee-58be-990c-4fdf7f9c0ede", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24880 affects version 9.0.13-tuxcare.2 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-29129", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.2" } ], "bom-ref": "urn:uuid:076c3581-f7c6-5714-bb0b-c31baf92fdb6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-29129 does not affect version 9.0.13-tuxcare.2 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 CVE-2026-29129 affects Apache Tomcat versions with TLS 1.3 cipher suite configuration support, where a HashSet was used instead of LinkedHashSet in getJsseCipherNames(), causing the configured cipher preference order to be lost when combining TLS 1.3 and legacy cipher lists. Version 9.0.13 predates the TLS 1.3 cipher suite feature entirely (introduced in commit 4ee45c5571 on Jan 6, 2026) and us...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-32990", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.2" } ], "bom-ref": "urn:uuid:05e5e703-4caa-5b4a-aa8a-a04049e42f75", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-32990 affects version 9.0.13-tuxcare.2 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-41293", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.2" } ], "bom-ref": "urn:uuid:fac082bb-d8f7-5ad6-b37d-04bac4c258bd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41293 affects version 9.0.13-tuxcare.2 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-65637", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.2" } ], "bom-ref": "urn:uuid:86a4ca45-7e75-5b1e-9901-f497356e4646", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65637 affects version 9.0.13-tuxcare.2 of org.apache.tomcat:tomcat-coyote." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.13-tuxcare.2" } ] }