{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:28db016d-864b-5999-b9db-39142f374b18",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "tomcat-util",
      "purl": "pkg:maven/org.apache.tomcat/tomcat-util@10.1.16-tuxcare.2",
      "type": "library",
      "group": "org.apache.tomcat",
      "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-util@10.1.16-tuxcare.2",
      "version": "10.1.16-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "tomcat-util",
            "purl": "pkg:maven/org.apache.tomcat/tomcat-util@10.1.16",
            "type": "library",
            "group": "org.apache.tomcat",
            "version": "10.1.16"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2016-8745",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-util@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:84712394-271b-59ba-b4a2-c9b4acb4e637",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-8745 does not affect version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat-util. CVE-2016-8745 is NOT present in Apache Tomcat 10.1.16. The vulnerability (Processor double-add to cache due to unguarded error handling in sendfile) was fixed by upstream Apache in commit cbc9b18a84 (Nov 2016) and shipped in the upstream release before TuxCare onboarded version 10.1.16. The fix is present in NioEndpoint.java:955-969 where error handlers conditionally cleanup only when NOT called by processor, preventing the Processor from being added to cache multiple times.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M14; >= 8.5.0, < 8.5.9; >= 8.0.0-RC1, < 8.0.41; >= 7.0.0, < 7.0.75; >= 6.0.16, < 6.0.50), NVD (= 7.0.0; = 7.0.1; = 7.0.2; = 7.0.3; = 7.0.4; = 7.0.5; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.52; = 7.0.53; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 8.0; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc3; = 8.0.0-rc5; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.8; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M13; >= 8.5.0, <= 8.5.8; >= 8.0.0.RC1, <= 8.0.39; >= 7.0.0, <= 7.0.73; >= 6.0.16, <= 6.0.48), Snyk (<= 0; >= 7, < 7.0.74; >= 8.5.0, < 8.5.9; >= 8.0.0RC1, < 8.0.40; >= 9.0.0M1, < 9.0.0M15; >= 7, < 7.0.74; >= 8.5.0, < 8.5.9; >= 8.0.0RC1, < 8.0.40; >= 9.0.0M1, < 9.0.0M15; >= 7, < 7.0.74; >= 8.5.0, < 8.5.9; >= 8.0.0RC1, < 8.0.40; >= 9.0.0M1, < 9.0.0M15).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-45143",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-util@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:48897a1f-f4c3-54d0-8fb6-6383b77525a8",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-45143 does not affect version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat-util. CVE-2022-45143 is not present in Apache Tomcat 10.1.16. The vulnerability concerns missing escaping in JsonErrorReportValve that could allow JSON injection. The fix was already included in the upstream Apache Tomcat 10.1.16 release that TuxCare onboarded. The JsonErrorReportValve.java file at lines 86-88 properly uses JSONFilter.escape() to escape type, message, and description fields before embedding them in JSON output, preventing JSON injection and malformed output. The fix commit (1f50bff8daabb48c5f15398689988f26aac6ec56) was authored by Mark Thomas (markt@apache.org) and is an ancestor of TuxCare's onboarding commit (e1463febbc), confirming it shipped in the original upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0, < 10.1.2; >= 10.1.0, < 10.1.2; >= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69), NVD (>= 9.0.40, < 9.0.69; = 8.5.83; = 10.1.0-milestone1; = 10.1.0-milestone10; = 10.1.0-milestone11; = 10.1.0-milestone12; = 10.1.0-milestone13; = 10.1.0-milestone14; = 10.1.0-milestone15; = 10.1.0-milestone16; = 10.1.0-milestone17; = 10.1.0-milestone2; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8; = 10.1.0-milestone9; = 10.1.1), cve.org (>= 10.1.0-M1, <= 10.1.1; >= 9.0.40, <= 9.0.68; = 8.5.83), Snyk (>= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0-M1, < 10.1.2; >= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0-M1, < 10.1.2; >= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0-M1, < 10.1.2).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-42795",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-util@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:df67ced5-92ed-5520-ac04-21c60dd0cc64",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-42795 does not affect version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat-util. not_affected \u2014 Apache Tomcat 10.1.16 is not affected by CVE-2023-42795. The vulnerability affects versions 10.1.0-M1 through 10.1.13, and was fixed in 10.1.14 and later. Since 10.1.16 > 10.1.14, the fix was already present in the upstream release when TuxCare onboarded it. All five recycle() method fixes (exception handling in Request.part.delete(), ApplicationHttpRequest.session.endAccess(), B2CConverter.dec...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-53434",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-util@10.1.16-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:65022021-63cf-593e-82ec-1026849d3d0c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-53434 affects version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat-util."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.tomcat/tomcat-util@10.1.16-tuxcare.2"
    }
  ]
}