{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:b9c1c876-598f-58b8-96b0-28c8c2767ce2",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "tomcat-util",
      "purl": "pkg:maven/org.apache.tomcat/tomcat-util@10.1.55-tuxcare.1",
      "type": "library",
      "group": "org.apache.tomcat",
      "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-util@10.1.55-tuxcare.1",
      "version": "10.1.55-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "tomcat-util",
            "purl": "pkg:maven/org.apache.tomcat/tomcat-util@10.1.55",
            "type": "library",
            "group": "org.apache.tomcat",
            "version": "10.1.55"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2016-8745",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-util@10.1.55-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:7d68874a-ecf6-534d-a910-e45946b9dc63",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-8745 does not affect version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-util. CVE-2016-8745 is NOT present in Tomcat 10.1.55. The vulnerability (Processor object added to cache multiple times due to cancelledKey() calls in sendfile error paths) was fixed by Apache upstream in commit cbc9b18a84 (Nov 2016), and this fix was already present in the upstream Tomcat release that TuxCare onboarded. The target code at java/org/apache/tomcat/util/net/NioEndpoint.java:970-984 shows the fixed pattern: error handlers do NOT call cancelledKey(), preventing double-caching of Processor objects.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M14; >= 8.5.0, < 8.5.9; >= 8.0.0-RC1, < 8.0.41; >= 7.0.0, < 7.0.75; >= 6.0.16, < 6.0.50), NVD (= 7.0.0; = 7.0.1; = 7.0.2; = 7.0.3; = 7.0.4; = 7.0.5; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.52; = 7.0.53; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 8.0; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc3; = 8.0.0-rc5; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.8; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M13; >= 8.5.0, <= 8.5.8; >= 8.0.0.RC1, <= 8.0.39; >= 7.0.0, <= 7.0.73; >= 6.0.16, <= 6.0.48), Snyk (<= 0; >= 7, < 7.0.74; >= 8.5.0, < 8.5.9; >= 8.0.0RC1, < 8.0.40; >= 9.0.0M1, < 9.0.0M15; >= 7, < 7.0.74; >= 8.5.0, < 8.5.9; >= 8.0.0RC1, < 8.0.40; >= 9.0.0M1, < 9.0.0M15; >= 7, < 7.0.74; >= 8.5.0, < 8.5.9; >= 8.0.0RC1, < 8.0.40; >= 9.0.0M1, < 9.0.0M15).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-45143",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-util@10.1.55-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:f5bcc382-0d5f-54e6-80bb-2b1e30e52de6",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-45143 does not affect version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-util. Target version 10.1.55 is NOT affected by CVE-2022-45143. The vulnerability concerns missing JSON escaping in JsonErrorReportValve's type, message, and description fields, allowing JSON injection attacks. The fix (commit 1f50bff8da by Mark Thomas, dated 2022-11-09) that adds JSONFilter.escape() calls was already present in the upstream Apache Tomcat 10.1.55 release before TuxCare onboarded this version. The CVE affects versions 10.1.0-M1 to 10.1.1; version 10.1.55 is significantly later and contains the upstream fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0, < 10.1.2; >= 10.1.0, < 10.1.2; >= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69), NVD (>= 9.0.40, < 9.0.69; = 8.5.83; = 10.1.0-milestone1; = 10.1.0-milestone10; = 10.1.0-milestone11; = 10.1.0-milestone12; = 10.1.0-milestone13; = 10.1.0-milestone14; = 10.1.0-milestone15; = 10.1.0-milestone16; = 10.1.0-milestone17; = 10.1.0-milestone2; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8; = 10.1.0-milestone9; = 10.1.1), cve.org (>= 10.1.0-M1, <= 10.1.1; >= 9.0.40, <= 9.0.68; = 8.5.83), Snyk (>= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0-M1, < 10.1.2; >= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0-M1, < 10.1.2; >= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0-M1, < 10.1.2).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-42795",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-util@10.1.55-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:0ce3dcec-0a3c-5097-9acc-1e9150e17df6",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-42795 does not affect version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-util. not_affected \u2014 CVE-2023-42795 (Incomplete Cleanup vulnerability) is not present in Tomcat 10.1.55. The upstream fix by Mark Thomas (commit 9375d67106) was included in the Apache Tomcat 10.1.55 release that TuxCare onboarded. All required defensive changes are present: try-catch blocks in recycle() methods for Request.java, ApplicationHttpRequest.java, B2CConverter.java, and C2BConverter.java ensure cleanup co...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-53434",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-util@10.1.55-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:ecec901c-2e94-5068-ba75-3098a782f518",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-53434 affects version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-util, and is fixed in 10.1.55-tuxcare.2."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.tomcat/tomcat-util@10.1.55-tuxcare.1"
    }
  ]
}