{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:5da8b566-1567-54d6-b9b3-a61d065e0bb5", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat-coyote", "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.39-tuxcare.1", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.39-tuxcare.1", "version": "9.0.39-tuxcare.1", "pedigree": { "ancestors": [ { "name": "tomcat-coyote", "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.39", "type": "library", "group": "org.apache.tomcat", "version": "9.0.39" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-0095", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.39-tuxcare.1" } ], "bom-ref": "urn:uuid:0bab4bca-1577-581e-9168-326b8dabc090", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0095 does not affect version 9.0.39-tuxcare.1 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 CVE-2014-0095 describes a denial of service vulnerability where AJP requests with Content-Length: 0 cause thread hangs. The target (Apache Tomcat 9.0.39) is NOT AFFECTED because the fix was already present in the upstream release. The fix, authored by Mark Thomas (markt@apache.org) in commit 13a80dba1f on 2014-11-23, explicitly handles Content-Length: 0 by immediately setting endOfStream=true a...", "justification": "code_not_present" } }, { "id": "CVE-2016-6816", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.39-tuxcare.1" } ], "bom-ref": "urn:uuid:4c9950ea-d347-5b6e-bb96-6317fcac01d6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-6816 does not affect version 9.0.39-tuxcare.1 of org.apache.tomcat:tomcat-coyote. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. The upstream fix was released in 9.0.0.M12, and version 9.0.39 is a later release of the same line. Advisories: GitHub GHSA-jc7p-5r39-9477 (fixed in 9.0.0.M12), NVD (last affected 9.0.0-milestone11), CVE record (last affected 9.0.0.M11), Snyk (fixed in 9.0.0.M13).", "justification": "code_not_present" } }, { "id": "CVE-2017-5651", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.39-tuxcare.1" } ], "bom-ref": "urn:uuid:da67cddd-dc17-528e-b6a3-5e1dfa23df19", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-5651 does not affect version 9.0.39-tuxcare.1 of org.apache.tomcat:tomcat-coyote. CVE-2017-5651 does not affect Tomcat 9.0.39. The vulnerability was fixed in upstream commit 9233d9d6a018be4415d4d7d6cb4fe01176adf1a8 by Mark Thomas on 2017-03-24, which was included in the 9.0.39 upstream release that TuxCare onboarded. The fix introduces SendfileState tracking to prevent the Processor from being added to the processor cache twice when sendfile completes quickly. All fix patterns are present in the target code: processSendfile() method, SendfileState enum usage, proper while loop condition checking sendfileState == SendfileState.DONE, and SocketState.SENDFILE return based on sendfileState == SendfileState.PENDING rather than sendfileData != null.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12), Snyk (>= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19).", "justification": "code_not_present" } }, { "id": "CVE-2019-0199", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.39-tuxcare.1" } ], "bom-ref": "urn:uuid:d8db919a-2205-5ada-a94f-b7e3dbdeb701", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-0199 does not affect version 9.0.39-tuxcare.1 of org.apache.tomcat:tomcat-coyote. CVE-2019-0199 affects Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37. The target version is 9.0.39, which is beyond the vulnerable range. All three defense mechanisms from the upstream patches are present: (1) stream read timeout enforcement that resets streams after timeout, (2) stream write timeout enforcement that cancels streams waiting for flow control, and (3) overhead frame tracking that closes connections sending excessive control frames. These fixes were already included in the upstream Apache Tomcat 9.0.39 release that TuxCare onboarded, authored by markt@apache.org. The vulnerable pattern (indefinite blocking without timeouts, unlimited overhead frames) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38; >= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38), NVD (>= 8.5.0, <= 8.5.37; >= 9.0.1, <= 9.0.14; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.14; >= 8.5.0, <= 8.5.37), Snyk (>= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16).", "justification": "code_not_present" } }, { "id": "CVE-2020-13934", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.39-tuxcare.1" } ], "bom-ref": "urn:uuid:27737b12-d4c3-5a69-be31-d7e1a542f876", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-13934 does not affect version 9.0.39-tuxcare.1 of org.apache.tomcat:tomcat-coyote. Target is Apache Tomcat 9.0.39 (tag 6989c4e936, product identity confirmed via ServerInfo.properties + repo layout). CVE-2020-13934 is a memory-exhaustion DoS: on a direct h2c (HTTP/2 cleartext, prior-knowledge) connection, Tomcat upgraded the HTTP/1.1 processor to an HTTP/2 processor WITHOUT releasing/recycling the old Http11Processor, leaking one processor per such connection until OutOfMemoryError. CVE affected range: 9.0.0.M5\u20139.0.36 (fixed 9.0.37). The upstream fix (commit 172977f04a by Mark Thomas , \"Ensure HTTP/1.1 processor is recycled after a direct h2c connection\") IS an ancestor of HEAD, and the current code at java/org/apache/coyote/AbstractProtocol.java exactly matches the post-fix state: line 880 adds `release(processor);` before swapping to the upgrade processor, and line 893 uses `state = SocketState.CLOSED;` (exit loop \u2192 clean-up) instead of the pre-fix `return SocketState.CLOSED;`. The pre-fix vulnerable pattern is absent. Fix author is upstream Apache (apache.org), not TuxCare/CloudLinux, so verdict is not_affected (vendor-fix) with justification code_not_present, not already_fixed.", "justification": "code_not_present" } }, { "id": "CVE-2020-13943", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.39-tuxcare.1" } ], "bom-ref": "urn:uuid:ff857d7a-3deb-5a96-8a45-7d799484f3c7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-13943 does not affect version 9.0.39-tuxcare.1 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 Apache Tomcat 9.0.39 is not affected by CVE-2020-13943. The vulnerability affected versions 9.0.0.M1 to 9.0.37. The target version (9.0.39) already contains the upstream fix (commit 55911430df) authored by Mark Thomas , which moved the maxConcurrentStreams validation from headersStart() to headersEnd(), preventing HTTP/2 header confusion between requests.", "justification": "code_not_present" } }, { "id": "CVE-2020-17527", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.39-tuxcare.1" } ], "bom-ref": "urn:uuid:e19afacf-eec0-51e5-b130-29f16ac3b03a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-17527 affects version 9.0.39-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2021-25122", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.39-tuxcare.1" } ], "bom-ref": "urn:uuid:a0f93a30-7034-5ab9-ac03-add3a31fb5db", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-25122 affects version 9.0.39-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2022-42252", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.39-tuxcare.1" } ], "bom-ref": "urn:uuid:80e33bd1-6809-59ff-9688-afacfd07e007", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-42252 affects version 9.0.39-tuxcare.1 of org.apache.tomcat:tomcat-coyote, and is fixed in 9.0.39-tuxcare.2." } }, { "id": "CVE-2023-24998", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.39-tuxcare.1" } ], "bom-ref": "urn:uuid:38f6fb2c-f77c-5872-bbc9-553cdfc22c60", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-24998 affects version 9.0.39-tuxcare.1 of org.apache.tomcat:tomcat-coyote, and is fixed in 9.0.39-tuxcare.2." } }, { "id": "CVE-2023-28709", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.39-tuxcare.1" } ], "bom-ref": "urn:uuid:97149540-aed6-5032-a03a-bec1e9805950", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-28709 affects version 9.0.39-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-34981", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.39-tuxcare.1" } ], "bom-ref": "urn:uuid:e64fbd0a-e6f3-5587-907c-1d31174fe600", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-34981 affects version 9.0.39-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-42794", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.39-tuxcare.1" } ], "bom-ref": "urn:uuid:82395d3b-9969-5839-8e8f-51541c32323f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-42794 does not affect version 9.0.39-tuxcare.1 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 Target version 9.0.39 predates the vulnerable refactoring introduced in 9.0.70. The finalize() method that provides automatic cleanup of temporary files is present in the target (lines 549-559 of DiskFileItem.java), preventing the disk exhaustion vulnerability described in CVE-2023-42794. The vulnerable code pattern (absence of finalize()) was introduced in 9.0.70-9.0.80 and fixed in 9.0.81+. V...", "justification": "code_not_present" } }, { "id": "CVE-2023-44487", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.39-tuxcare.1" } ], "bom-ref": "urn:uuid:fbc4b1b0-6482-5f91-9a62-a6ad886e9006", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-44487 affects version 9.0.39-tuxcare.1 of org.apache.tomcat:tomcat-coyote, and is fixed in 9.0.39-tuxcare.2." } }, { "id": "CVE-2023-45648", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.39-tuxcare.1" } ], "bom-ref": "urn:uuid:3a516ee3-3349-524d-9c60-18899e4a1db4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-45648 is fixed in version 9.0.39-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-46589", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.39-tuxcare.1" } ], "bom-ref": "urn:uuid:a4cbcbbb-1884-547e-bfeb-f5b60ca1dd2e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-46589 affects version 9.0.39-tuxcare.1 of org.apache.tomcat:tomcat-coyote, and is fixed in 9.0.39-tuxcare.3." } }, { "id": "CVE-2024-21733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.39-tuxcare.1" } ], "bom-ref": "urn:uuid:7bfedf7a-0079-51ee-a6a9-96d8c3fc1d88", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-21733 affects version 9.0.39-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-24549", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.39-tuxcare.1" } ], "bom-ref": "urn:uuid:2aeb9dde-1e17-5d40-8ffe-10e5909afab3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-24549 affects version 9.0.39-tuxcare.1 of org.apache.tomcat:tomcat-coyote, and is fixed in 9.0.39-tuxcare.2." } }, { "id": "CVE-2024-34750", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.39-tuxcare.1" } ], "bom-ref": "urn:uuid:0b49ff48-b3a1-5e92-b215-8e2b75d0c29a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-34750 affects version 9.0.39-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-38286", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.39-tuxcare.1" } ], "bom-ref": "urn:uuid:ba3c5893-eec5-56dc-82bf-ad53191cbb31", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38286 affects version 9.0.39-tuxcare.1 of org.apache.tomcat:tomcat-coyote, and is fixed in 9.0.39-tuxcare.2." } }, { "id": "CVE-2024-52317", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.39-tuxcare.1" } ], "bom-ref": "urn:uuid:b17a4041-3416-5377-b98b-a0f9f4068f3a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-52317 does not affect version 9.0.39-tuxcare.1 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 Target version 9.0.39 is not affected by CVE-2024-52317. The vulnerability was introduced in version 9.0.93 (August 2024) when request/response recycling was added, and affects versions 9.0.92-9.0.95. Version 9.0.39 (released October 2020) predates the affected range by nearly 4 years and lacks the request/response recycling mechanism entirely. Without recycling, request/response objects cannot...", "justification": "code_not_present" } }, { "id": "CVE-2025-31650", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.39-tuxcare.1" } ], "bom-ref": "urn:uuid:2eca831b-06d1-52a7-b1fb-5a109f506a2c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-31650 does not affect version 9.0.39-tuxcare.1 of org.apache.tomcat:tomcat-coyote. Tomcat 9.0.39 does not have the vulnerable HTTP/2 priority (RFC 9218) feature. The Priority parser class, PRIORITY_UPDATE frame type, readPriorityUpdateFrame() method, and priority header processing do not exist in this version. RFC 9218 support was added in 2022-2023, after version 9.0.39 was released (2020-10-09). The vulnerability requires RFC 9218 priority field parsing, which is absent from this codebase.", "justification": "code_not_present" } }, { "id": "CVE-2025-48989", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.39-tuxcare.1" } ], "bom-ref": "urn:uuid:3247d742-86b7-55d2-85c9-0744bfce71f0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48989 is fixed in version 9.0.39-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2025-52434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.39-tuxcare.1" } ], "bom-ref": "urn:uuid:f81d7283-c836-50c2-b1ce-8c708523b028", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-52434 affects version 9.0.39-tuxcare.1 of org.apache.tomcat:tomcat-coyote, and is fixed in 9.0.39-tuxcare.2." } }, { "id": "CVE-2025-53506", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.39-tuxcare.1" } ], "bom-ref": "urn:uuid:6100acef-14ce-5724-bfa4-94af8d07cc95", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-53506 affects version 9.0.39-tuxcare.1 of org.apache.tomcat:tomcat-coyote, and is fixed in 9.0.39-tuxcare.2." } }, { "id": "CVE-2025-66614", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.39-tuxcare.1" } ], "bom-ref": "urn:uuid:e88cab4e-90cf-573b-99e5-3f7e3c0f5eac", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66614 affects version 9.0.39-tuxcare.1 of org.apache.tomcat:tomcat-coyote, and is fixed in 9.0.39-tuxcare.2." } }, { "id": "CVE-2026-24733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.39-tuxcare.1" } ], "bom-ref": "urn:uuid:aec7c9eb-b237-5d3d-ba68-2f0225b3344d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24733 affects version 9.0.39-tuxcare.1 of org.apache.tomcat:tomcat-coyote, and is fixed in 9.0.39-tuxcare.2." } }, { "id": "CVE-2026-24734", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.39-tuxcare.1" } ], "bom-ref": "urn:uuid:9ad0114a-270d-515d-9955-bdc77b5dcdc3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24734 affects version 9.0.39-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-24880", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.39-tuxcare.1" } ], "bom-ref": "urn:uuid:c03c41a5-c47f-5424-8e62-63ef88c4d147", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24880 affects version 9.0.39-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-29129", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.39-tuxcare.1" } ], "bom-ref": "urn:uuid:0f0ac09e-7c9a-5fad-8eaf-c83a6b5f70da", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-29129 does not affect version 9.0.39-tuxcare.1 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 CVE-2026-29129 describes a regression where configured cipher preference order was not preserved in Apache Tomcat versions 9.0.114-9.0.115, 10.1.51-10.1.52, and 11.0.16-11.0.18. The bug was introduced when TLS 1.3 cipher suite configuration support was added (commit 4ee45c5571, 2026-01-06), which used a HashSet to combine cipher lists, destroying the configured order. The fix (commit 8d69b33764...", "justification": "code_not_present" } }, { "id": "CVE-2026-32990", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.39-tuxcare.1" } ], "bom-ref": "urn:uuid:fc502f84-3687-57a0-88b3-f80001383cd7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-32990 affects version 9.0.39-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-41293", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.39-tuxcare.1" } ], "bom-ref": "urn:uuid:ad8367b3-8db1-50d1-9fc4-0107624b8daa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41293 affects version 9.0.39-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-65637", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.39-tuxcare.1" } ], "bom-ref": "urn:uuid:a1d334f2-58c7-5017-abeb-e3ee36e40807", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65637 affects version 9.0.39-tuxcare.1 of org.apache.tomcat:tomcat-coyote." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.39-tuxcare.1" } ] }