{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:ebd6dde4-5c90-5516-9687-32101512dd02", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat-coyote", "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.50-tuxcare.17", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.50-tuxcare.17", "version": "9.0.50-tuxcare.17", "pedigree": { "ancestors": [ { "name": "tomcat-coyote", "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.50", "type": "library", "group": "org.apache.tomcat", "version": "9.0.50" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-0095", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.50-tuxcare.17" } ], "bom-ref": "urn:uuid:4bb50f2d-62a4-5c3b-8f47-da5bed4e6875", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0095 does not affect version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 CVE-2014-0095 is NOT present in Tomcat 9.0.50. The vulnerability affected Apache Tomcat 8.x before 8.0.4, where Content-Length: 0 AJP requests caused thread hangs. The fix was applied by upstream Apache Tomcat in March 2014 (commit 8884dae60ac by Mark Thomas). This fix is present in the target at java/org/apache/coyote/ajp/AjpProcessor.java:627-630, where contentLength == 0 triggers immediate e...", "justification": "code_not_present" } }, { "id": "CVE-2016-6816", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.50-tuxcare.17" } ], "bom-ref": "urn:uuid:021ae9c3-f1fe-5b3c-8fba-c9efb9e73798", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-6816 does not affect version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat-coyote. Prechecker: The upstream fix is already in this version's source history (commit 516bda67). The upstream fix was released in 9.0.0.M12, and version 9.0.50 is a later release of the same line. Advisories: GitHub GHSA-jc7p-5r39-9477 (fixed in 9.0.0.M12), NVD (last affected 9.0.0-milestone11), CVE record (last affected 9.0.0.M11), Snyk (fixed in 9.0.0.M13).", "justification": "code_not_present" } }, { "id": "CVE-2017-5651", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.50-tuxcare.17" } ], "bom-ref": "urn:uuid:90ce2952-5bf7-5746-8f80-2b5a53fd65cc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-5651 does not affect version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat-coyote. Target version 9.0.50 is not affected by CVE-2017-5651. The vulnerability (processor double-caching during rapid sendfile completion causing response mix-up) was fixed by upstream commit 9233d9d6a0 (March 2017) authored by Mark Thomas. This fix was already present in the upstream release before TuxCare began maintaining this branch. The vulnerable code pattern (using sendfileData for state determination, clearing it in prepareRequest) is absent. The fix (SendfileState tracking, preserved sendfileData) is fully present in Http11Processor.java lines 262, 265, 451, 463, and the processSendfile method at line 1354.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12), Snyk (>= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19).", "justification": "code_not_present" } }, { "id": "CVE-2019-0199", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.50-tuxcare.17" } ], "bom-ref": "urn:uuid:fd6011fa-7d34-5277-9666-89402fb8c4ad", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-0199 does not affect version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat-coyote. CVE-2019-0199 addresses HTTP/2 DoS vulnerabilities via thread exhaustion. The target (Tomcat 9.0.50) is NOT AFFECTED because the upstream Apache Tomcat release already contained the complete fix before TuxCare onboarded it. Both defense mechanisms are present: (1) stream-level read/write timeouts (20s default) prevent indefinite blocking on I/O operations, and (2) overhead frame counting tracks the ratio of overhead frames (SETTINGS, PING, PRIORITY) to data frames, closing connections when the ratio exceeds safe thresholds. These fixes were authored by Mark Thomas (markt@apache.org) on Feb 1, 2019, and were part of the upstream release that TuxCare subsequently onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38; >= 9.0.0, < 9.0.16; >= 8.0.0, < 8.5.38), NVD (>= 8.5.0, <= 8.5.37; >= 9.0.1, <= 9.0.14; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.14; >= 8.5.0, <= 8.5.37), Snyk (>= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16; >= 8.5.0, < 8.5.38; >= 9.0.0.M1, < 9.0.16).", "justification": "code_not_present" } }, { "id": "CVE-2020-13934", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.50-tuxcare.17" } ], "bom-ref": "urn:uuid:fdbcff66-e773-5053-b77b-c624275b604b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-13934 does not affect version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat-coyote. CVE-2020-13934 affects Apache Tomcat 9.0.0.M5-9.0.36", "justification": "code_not_present" } }, { "id": "CVE-2020-13943", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.50-tuxcare.17" } ], "bom-ref": "urn:uuid:ce7f4b30-0095-5cc2-b10f-f29feed00135", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-13943 does not affect version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat-coyote. Version 9.0.50 is not vulnerable. Summary: Target repository already has the fix for CVE-2020-13943 applied. The maxConcurrentStreams check is correctly located in headersEnd() method, not in headersStart(). [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "code_not_present" } }, { "id": "CVE-2020-17527", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.50-tuxcare.17" } ], "bom-ref": "urn:uuid:c6ad1531-ccd6-5264-8b6d-7cc1145a9f72", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-17527 does not affect version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat-coyote. CVE-2020-17527: HTTP/2 header value reuse vulnerability is NOT present in Apache Tomcat 9.0.50. The vulnerable pattern (shared mutable StringBuilder in HpackDecoder causing header value leakage between concurrent HTTP/2 streams) was fixed by upstream Apache in version 9.0.40 (commit d56293f816, authored by Mark Thomas on 2020-11-09). The fix replaced the instance-level StringBuilder with local instances in readHpackString() and readHuffmanString() methods, isolating each header decoding operation. This upstream fix was already present when TuxCare onboarded version 9.0.50.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M10; >= 9.0.0-M1, < 9.0.40; >= 8.5.0, < 8.5.60), NVD (>= 8.5.1, <= 8.5.59; >= 9.0.1, <= 9.0.35; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 9.0.35-3.39.1; = 9.0.35-3.57.3; = 9.0.36; = 9.0.37; = 9.0.38; = 9.0.39; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10.0.0-M1, <= 10.0.0-M9; = 10; >= 9.0.0-M1, <= 9.0.39; = 9; >= 8.5.0, <= 8.5.59; = 8.5), Snyk (<= 0; >= 8.5.0, < 8.5.60; >= 9.0.0, < 9.0.40; >= 10.0.0-M1, < 10.0.0-M10).", "justification": "code_not_present" } }, { "id": "CVE-2021-25122", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.50-tuxcare.17" } ], "bom-ref": "urn:uuid:2378f0ec-bcb8-53d0-bdab-0da2205bd8a1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-25122 does not affect version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat-coyote. CVE-2021-25122 affects Apache Tomcat 9.0.0.M1 to 9.0.41, where h2c connection handling could duplicate request headers and body data between users. The target is Tomcat 9.0.50-tuxcare.16, which is after the affected range. All four upstream fix commits (addressing bug 64830) are present on HEAD and were shipped in the Apache Tomcat 9.0.50 release before any TuxCare modifications. Direct code inspection confirms the fixes: AbstractProtocol.java restores leftover input before processor creation (line 906), HpackDecoder.java uses local StringBuilder instances (lines 226, 234), and ConnectionSettingsBase.java uses ConcurrentHashMap for thread safety (lines 47-48). The vulnerability pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.2; >= 9.0.0-M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 10.0.0-M1, < 10.0.2), NVD (>= 8.5.0, <= 8.5.61; >= 9.0.0, <= 9.0.41; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 10.0.0; = 10.0.0-milestone1; = 10.0.0-milestone10; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6; = 10.0.0-milestone7; = 10.0.0-milestone8; = 10.0.0-milestone9), cve.org (>= 10, < 10.0.2; >= 9, < 9.0.42; >= 8.5, < 8.5.62), Snyk (>= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; >= 10.0.0-M1, < 10.0.2; >= 9.0.0.M1, < 9.0.43; >= 8.5.0, < 8.5.63; <= 0).", "justification": "code_not_present" } }, { "id": "CVE-2022-42252", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.50-tuxcare.17" } ], "bom-ref": "urn:uuid:f75c91a0-acb5-5c9b-8a3e-04354d38f75d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-42252 is fixed in version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-24998", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.50-tuxcare.17" } ], "bom-ref": "urn:uuid:f3e0b43f-beed-5988-83b6-33e41b71bc20", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-24998 is fixed in version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-28709", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.50-tuxcare.17" } ], "bom-ref": "urn:uuid:260554c1-ec9d-56fc-a16b-d24a722ff190", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-28709 is fixed in version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-34981", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.50-tuxcare.17" } ], "bom-ref": "urn:uuid:c61680b0-dc74-51e5-93df-6cb2073166ed", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-34981 affects version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-42794", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.50-tuxcare.17" } ], "bom-ref": "urn:uuid:e2da760e-79c5-5631-92bb-d5f9bad65872", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-42794 does not affect version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 Apache Tomcat 9.0.50 is NOT affected by CVE-2023-42794. The target version (released June 28, 2021) predates the vulnerable versions (9.0.70-9.0.80) and already contains the finalize() method that prevents the vulnerability. The CVE describes a denial-of-service issue introduced by \"unreleased, in progress refactoring\" that removed the finalize() cleanup method in versions 9.0.70-9.0.80. Versio...", "justification": "code_not_present" } }, { "id": "CVE-2023-44487", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.50-tuxcare.17" } ], "bom-ref": "urn:uuid:578e6e0a-dff8-5475-82bc-c6fa23911039", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-44487 is fixed in version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-45648", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.50-tuxcare.17" } ], "bom-ref": "urn:uuid:e795fe71-bb5e-57ea-897e-dbe7baeb3f92", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-45648 is fixed in version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2023-46589", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.50-tuxcare.17" } ], "bom-ref": "urn:uuid:032eea92-2741-501f-aff4-0767e0d05c98", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-46589 is fixed in version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-21733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.50-tuxcare.17" } ], "bom-ref": "urn:uuid:283afb3b-a280-58d4-90b5-18539d4e0b3b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-21733 does not affect version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 The target Apache Tomcat 9.0.50-tuxcare.16 is not affected by CVE-2024-21733. The vulnerability affects versions 9.0.0-M11 through 9.0.43, and the fix was introduced in upstream version 9.0.44 (February 2021). Since the target is based on upstream 9.0.50 (released June 2021), the fix was already present in the upstream release when TuxCare adopted this version. Both required patches are present...", "justification": "code_not_present" } }, { "id": "CVE-2024-24549", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.50-tuxcare.17" } ], "bom-ref": "urn:uuid:3752f41b-f43b-5146-9850-191f6340a031", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-24549 is fixed in version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-34750", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.50-tuxcare.17" } ], "bom-ref": "urn:uuid:a74d2f0b-b903-5b3f-a904-7e00859e494a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34750 is fixed in version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-38286", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.50-tuxcare.17" } ], "bom-ref": "urn:uuid:133a33e0-2193-5189-8241-9f88030a4384", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38286 is fixed in version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2024-52317", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.50-tuxcare.17" } ], "bom-ref": "urn:uuid:3d7725a9-2927-55ab-baae-871093754cb5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-52317 does not affect version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 Apache Tomcat 9.0.50 does not contain CVE-2024-52317. The vulnerability affects versions 9.0.92-9.0.95 where request/response object pooling was introduced. In 9.0.50, Request objects are created new for each HTTP/2 stream (Stream.java:104 `new Request()`), and no pooling mechanism exists. The vulnerable code path (pushRequestAndResponse/popRequestAndResponse methods for returning objects to a ...", "justification": "code_not_present" } }, { "id": "CVE-2025-31650", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.50-tuxcare.17" } ], "bom-ref": "urn:uuid:c91d2cda-02e7-5de4-b80b-f9a0a9928c31", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-31650 does not affect version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat-coyote. 9.0.50 predates HTTP/2 RFC 9218 PRIORITY_UPDATE frame support (added in 9.0.76). Advisory range per NVD/Snyk/GHSA is 9.0.76-9.0.102. Code inspection confirms: Http2Parser.processFramePriorityUpdate method and priority parsing in Stream.emitHeader do not exist in this baseline. Vulnerable code path is absent.", "justification": "code_not_present" } }, { "id": "CVE-2025-48989", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.50-tuxcare.17" } ], "bom-ref": "urn:uuid:7cb980a5-b8e9-528d-89bb-990e2dc59ace", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48989 is fixed in version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2025-52434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.50-tuxcare.17" } ], "bom-ref": "urn:uuid:eef8a510-e65e-5f51-9097-1e67419078f0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-52434 is fixed in version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2025-53506", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.50-tuxcare.17" } ], "bom-ref": "urn:uuid:98b70081-a255-51ab-a9ff-3bc84def62ce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-53506 is fixed in version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2025-66614", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.50-tuxcare.17" } ], "bom-ref": "urn:uuid:dcfc4803-729a-5eec-b320-31d7a1f87f9d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66614 is fixed in version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-24733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.50-tuxcare.17" } ], "bom-ref": "urn:uuid:344aa675-dfa2-5d18-a209-2f572716eaff", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-24733 is fixed in version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-24734", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.50-tuxcare.17" } ], "bom-ref": "urn:uuid:0e6f22e8-95b1-54d5-9f73-77c88ea7897c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24734 affects version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-24880", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.50-tuxcare.17" } ], "bom-ref": "urn:uuid:c3466f42-57b2-53fa-b6a5-58060980be7a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24880 affects version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-29129", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.50-tuxcare.17" } ], "bom-ref": "urn:uuid:86a1b8b8-7a35-52bb-8bc3-1951013351db", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-29129 does not affect version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat-coyote. not_affected \u2014 Apache Tomcat 9.0.50 is NOT affected by CVE-2026-29129. This vulnerability affects versions 9.0.114-9.0.115, 10.1.51-10.1.52, and 11.0.16-11.0.18. The target version 9.0.50 predates the vulnerable code by 64 minor versions. The bug was introduced when TLS 1.3 cipher suite support was added (commit 4ee45c5571, January 2026), which used a HashSet that destroyed the configured cipher order. Versio...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-32990", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.50-tuxcare.17" } ], "bom-ref": "urn:uuid:b933a699-3917-5814-9a72-553b6e32578c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-32990 affects version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-41293", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.50-tuxcare.17" } ], "bom-ref": "urn:uuid:908bf177-0db9-5239-beee-716bc669c404", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41293 affects version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat-coyote." } }, { "id": "CVE-2026-65637", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.50-tuxcare.17" } ], "bom-ref": "urn:uuid:1518338c-c289-5d0b-80c5-fdd10aeda319", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65637 affects version 9.0.50-tuxcare.17 of org.apache.tomcat:tomcat-coyote." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.50-tuxcare.17" } ] }