{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:3cd1cda4-5fab-5625-9c23-f15622e43608",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "tomcat-util",
      "purl": "pkg:maven/org.apache.tomcat/tomcat-util@7.0.109-tuxcare.7",
      "type": "library",
      "group": "org.apache.tomcat",
      "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-util@7.0.109-tuxcare.7",
      "version": "7.0.109-tuxcare.7",
      "pedigree": {
        "ancestors": [
          {
            "name": "tomcat-util",
            "purl": "pkg:maven/org.apache.tomcat/tomcat-util@7.0.109",
            "type": "library",
            "group": "org.apache.tomcat",
            "version": "7.0.109"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2016-8745",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-util@7.0.109-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:1bdfdb15-32d4-538d-bd5f-472225fb34f1",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-8745 does not affect version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat-util. CVE-2016-8745 affects Apache Tomcat 7.0.0-7.0.73",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-45143",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-util@7.0.109-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:ed86ea4f-1eab-59ba-a67c-0f99543e66db",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-45143 is fixed in version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat-util."
      }
    },
    {
      "id": "CVE-2023-42795",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-util@7.0.109-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:d9e237a7-1cb8-5f6c-ba6b-238a118ec624",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-42795 affects version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat-util."
      }
    },
    {
      "id": "CVE-2026-53434",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-util@7.0.109-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:4c8101ef-f376-531d-be16-2baf1f5c2a31",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-53434 does not affect version 7.0.109-tuxcare.7 of org.apache.tomcat:tomcat-util. Prechecker: No vulnerable code from the fix was found; the vulnerable lines are absent, this version declares none of the classes the fix changes, and their base package is absent. Version 7.0.109 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-4x29-79gh-6v8q (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (newer lines only).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.tomcat/tomcat-util@7.0.109-tuxcare.7"
    }
  ]
}