{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:06f25fbb-ab09-5579-aaf4-581c2bc830f3", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat", "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.13-tuxcare.4", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.13-tuxcare.4", "version": "9.0.13-tuxcare.4", "pedigree": { "ancestors": [ { "name": "tomcat", "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.13", "type": "library", "group": "org.apache.tomcat", "version": "9.0.13" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2008-1947", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.13-tuxcare.4" } ], "bom-ref": "urn:uuid:a5dfceb3-6e7f-568d-ac72-7e9a615dadab", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2008-1947 does not affect version 9.0.13-tuxcare.4 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2008-1947 does not affect Tomcat 9.0.75-tuxcare.7. This XSS vulnerability in the host-manager application was fixed by Apache in June 2008, more than 10 years before the 9.0.13 upstream release (November 2018) that TuxCare onboarded. The target code includes comprehensive XSS defenses: all user-supplied input (hostname, aliases, messages) is HTML-encoded via Escape.htmlElementContent() befo...", "justification": "code_not_present" } }, { "id": "CVE-2013-4590", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.13-tuxcare.4" } ], "bom-ref": "urn:uuid:05fb540a-f672-55f6-bb6b-061ccb7c4db8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-4590 does not affect version 9.0.13-tuxcare.4 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2013-4590 (XXE in Tomcat XML parsers) is NOT present in this target. The fix was already included in the upstream Apache Tomcat 9.0.13 release that TuxCare onboarded. The target contains the complete XXE blocking defense: LocalResolver blocks external entity resolution when blockExternal=true (enabled by default), preventing attackers from accessing server-side files or internal network res...", "justification": "code_not_present" } }, { "id": "CVE-2015-5174", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.13-tuxcare.4" } ], "bom-ref": "urn:uuid:b02a132e-5dd3-55a2-8e09-a6c1ed85de29", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2015-5174 does not affect version 9.0.13-tuxcare.4 of org.apache.tomcat:tomcat. not_affected \u2014 The target Tomcat 9.0.13 is not affected by CVE-2015-5174. The vulnerability (directory traversal via paths like `//..`, `/a/../..` bypassing validation) was fixed upstream in April 2016 (commit 47ecd0d0f9b) using a trailing-slash normalization approach. This fix was already present in the upstream Apache Tomcat 9.0.13 release (October 2018) that TuxCare onboarded. The vulnerable pattern\u2014where ...", "justification": "code_not_present" } }, { "id": "CVE-2015-5346", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.13-tuxcare.4" } ], "bom-ref": "urn:uuid:d78cf89c-6303-5d4a-ba21-a9a355dbcb6e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2015-5346 does not affect version 9.0.13-tuxcare.4 of org.apache.tomcat:tomcat. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. The upstream fix was released in 9.0.0.M2, and version 9.0.13 is a later release of the same line. Advisories: GitHub GHSA-jrcp-c39h-r29x (fixed in 9.0.0.M2), NVD (last affected 9.0.0-milestone1).", "justification": "code_not_present" } }, { "id": "CVE-2016-0706", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.13-tuxcare.4" } ], "bom-ref": "urn:uuid:e02177a8-fe0c-59e3-8110-a933460c0cf1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-0706 does not affect version 9.0.13-tuxcare.4 of org.apache.tomcat:tomcat. not_affected \u2014 Target Tomcat 9.0.13 is not affected by CVE-2016-0706. The vulnerability allowed non-privileged web applications to load StatusManagerServlet and read arbitrary HTTP requests/session IDs. The fix (adding StatusManagerServlet to RestrictedServlets.properties) was applied by Apache in commit c8601f802d (January 2016) and was already present in the upstream 9.0.13 release that TuxCare onboarded. T...", "justification": "code_not_present" } }, { "id": "CVE-2016-0762", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.13-tuxcare.4" } ], "bom-ref": "urn:uuid:a85f2ef2-c15a-5b7c-a49a-521a77c1ad71", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-0762 does not affect version 9.0.13-tuxcare.4 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2016-0762 describes a timing attack vulnerability where Realm implementations did not process passwords when usernames didn't exist, allowing attackers to enumerate valid usernames through response time analysis. The upstream fix (commit 86b2e43609 by Mark Thomas, August 2016) adds dummy password processing via getCredentialHandler().mutate(credentials) when user lookup fails. This fix was ...", "justification": "code_not_present" } }, { "id": "CVE-2016-0763", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.13-tuxcare.4" } ], "bom-ref": "urn:uuid:02aa0bb5-ce59-5439-9d75-c7600dc7815d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-0763 does not affect version 9.0.13-tuxcare.4 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2016-0763 is not present in the target repository. The vulnerability required the absence of authorization checks in the setGlobalContext() method of ResourceLinkFactory. The target contains the upstream Apache fix (commit 76ebc90075) which adds a SecurityManager permission check, preventing unauthorized callers from manipulating the global JNDI context. This fix was already included in Tom...", "justification": "code_not_present" } }, { "id": "CVE-2016-6794", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.13-tuxcare.4" } ], "bom-ref": "urn:uuid:9181f963-deaa-56bc-8e7e-6ed12fcc4d01", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-6794 does not affect version 9.0.13-tuxcare.4 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2016-6794 is not present in Apache Tomcat 9.0.75-tuxcare.7. The vulnerability allowed web applications to bypass SecurityManager restrictions and read system properties through the configuration file property replacement feature. The fix, which adds permission checks before property access, was introduced by upstream Apache Tomcat in commit c1660182010b4255c21c874d69c124370a67784a (July 201...", "justification": "code_not_present" } }, { "id": "CVE-2016-6796", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.13-tuxcare.4" } ], "bom-ref": "urn:uuid:57290e36-2ec5-57da-aa56-d4aa3a13f808", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-6796 does not affect version 9.0.13-tuxcare.4 of org.apache.tomcat:tomcat. CVE-2016-6796 affects Apache Tomcat versions 9.0.0.M1 to 9.0.0.M9, allowing malicious web applications to bypass SecurityManager via manipulation of JSP Servlet configuration parameters. The target version 9.0.13 is not affected because the fix was already included in the upstream Apache Tomcat 9.0.13 release. The fix (commit f603f2f4595) adds checks in JspServlet.java and EmbeddedServletOptions.java to ignore engineOptionsClass and scratchdir parameters when SecurityManager is enabled, preventing the bypass. Both security checks are present in the target repository.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M10; >= 8.5.0, < 8.5.5; >= 8.0.0.RC1, < 8.0.37; >= 7.0.0, < 7.0.71; >= 6.0.0, < 6.0.46), NVD (>= 6.0.0, <= 6.0.45; >= 7.0.0, <= 7.0.70; >= 8.0, <= 8.0.36; >= 8.5.0, <= 8.5.4; = 9.0.0-milestone1; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M9; >= 8.5.0, <= 8.5.4; >= 8.0.0.RC1, <= 8.0.36; >= 7.0.0, <= 7.0.70; >= 6.0.0, <= 6.0.45), Snyk (>= 7.0.0, < 7.0.72; >= 8, < 8.0.37; >= 8.5.0, < 8.5.5; >= 9-alpha, < 9.0.0.M10).", "justification": "code_not_present" } }, { "id": "CVE-2016-6797", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.13-tuxcare.4" } ], "bom-ref": "urn:uuid:d12af78e-218e-5b56-a1bf-7c86c84f8205", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-6797 does not affect version 9.0.13-tuxcare.4 of org.apache.tomcat:tomcat. Apache Tomcat 9.0.13 is NOT affected by CVE-2016-6797. The vulnerability allowed web applications to access any global JNDI resource without explicit ResourceLink configuration. The fix (commit 2859ac3eae by Mark Thomas) was already present in the upstream Apache Tomcat 9.0.13 release. The target contains the complete defense: a per-ClassLoader registry (globalResourceRegistrations) that tracks allowed global resource accesses, with validation enforced in ResourceLinkFactory.getObjectInstance() before granting access to any global resource. Target version 9.0.13 is after the affected range (9.0.0.M1 to 9.0.0.M9).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M10; >= 8.5.0, < 8.5.5; >= 8.0.0, < 8.0.37; >= 7.0.0, < 7.0.72), NVD (>= 6.0.0, <= 6.0.45; >= 7.0.0, <= 7.0.70; >= 8.0, <= 8.0.36; >= 8.5.0, <= 8.5.4; = 9.0.0-milestone1; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M9; >= 8.5.0, <= 8.5.4; >= 8.0.0.RC1, <= 8.0.36; >= 7.0.0, <= 7.0.70; >= 6.0.0, <= 6.0.45), Snyk (>= 7.0.0, < 7.0.72; >= 8, < 8.0.37; >= 8.5.0, < 8.5.5; >= 9-alpha, < 9.0.0.M10; >= 7.0.0, < 7.0.72; >= 8, < 8.0.37; >= 8.5.0, < 8.5.5; >= 9-alpha, < 9.0.0.M10).", "justification": "code_not_present" } }, { "id": "CVE-2016-6817", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.13-tuxcare.4" } ], "bom-ref": "urn:uuid:ad456fc4-c36a-5e54-81fb-95ebaa4621dc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-6817 does not affect version 9.0.13-tuxcare.4 of org.apache.tomcat:tomcat. CVE-2016-6817: Apache Tomcat HTTP/2 infinite loop DoS vulnerability. The target (version 9.0.13, SHA c9a801ca) is NOT AFFECTED. The vulnerability was fixed by Apache upstream in October 2016 (commit 85c63227, bug 60232) by adding dynamic buffer expansion to Http2Parser.readHeaderPayload(). This fix was already present in the Apache Tomcat 9.0.13 release (tagged November 2, 2018, commit 706a395be7) that TuxCare onboarded in September 2026. The fix code is present in java/org/apache/coyote/http2/Http2Parser.java lines 452-466, which dynamically expands headerReadBuffer when it fills, preventing the infinite loop that caused DoS. This is an upstream vendor fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M12; >= 8.5.0, < 8.5.8), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M11; >= 8.5.0, <= 8.5.6), Snyk (>= 8.5.0, < 8.5.8; >= 9.0.0M1, < 9.0.0M13; >= 8.5.0, < 8.5.8; >= 9.0.0M1, < 9.0.0M13).", "justification": "code_not_present" } }, { "id": "CVE-2016-8747", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.13-tuxcare.4" } ], "bom-ref": "urn:uuid:a9e974bf-db37-5862-8b5a-2d67c3713787", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-8747 does not affect version 9.0.13-tuxcare.4 of org.apache.tomcat:tomcat. CVE-2016-8747 affects Apache Tomcat 8.5.7-8.5.9 and 9.0.0.M11-9.0.0.M15. The target is Tomcat 9.0.13, which already contains the upstream fix committed by Mark Thomas on 2016-12-14. The fix properly resets ByteBuffer position and limit after compacting leftover bytes in nextRequest(), preventing cross-request data leakage. The vulnerable pattern (missing flip() after compact()) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.7, < 8.5.10; >= 9.0.0.M11, < 9.0.0.M16), NVD (>= 8.5.7, < 8.5.10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15), cve.org (>= 8.5.7, <= 8.5.9; >= 9.0.0.M11, <= 9.0.0.M15), Snyk (>= 8.5.7, < 8.5.10; >= 9.0.0.M11, < 9.0.0.M16; >= 8.5.7, < 8.5.10; >= 9.0.0.M11, < 9.0.0.M16).", "justification": "code_not_present" } }, { "id": "CVE-2017-5647", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.13-tuxcare.4" } ], "bom-ref": "urn:uuid:976e09f5-7305-5121-b77c-bb2ca1898e73", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-5647 does not affect version 9.0.13-tuxcare.4 of org.apache.tomcat:tomcat. CVE-2017-5647 affects Apache Tomcat 9.0.0.M1 to 9.0.0.M18. The target is running version 9.0.13, which is beyond the affected range. The upstream fix (commit 864aa1199a by Mark Thomas, dated 2017-03-27) was included starting with version 9.0.0.M19 and was already present in the Apache Tomcat 9.0.13 release when TuxCare onboarded it. All fix components are verified present in the target code: the SendfileKeepAliveState enum, the pipelined data detection logic in Http11Processor, and the immediate processing of pipelined requests in all endpoint implementations (NioEndpoint, AprEndpoint, Nio2Endpoint).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.43; >= 7.0.0, < 7.0.77; >= 6.0.0, < 6.0.53), NVD (= 6.0.0; = 6.0.1; = 6.0.2; = 6.0.3; = 6.0.4; = 6.0.5; = 6.0.6; = 6.0.7; = 6.0.8; = 6.0.9; = 6.0.10; = 6.0.11; = 6.0.12; = 6.0.13; = 6.0.14; = 6.0.15; = 6.0.16; = 6.0.17; = 6.0.18; = 6.0.19; = 6.0.20; = 6.0.21; = 6.0.22; = 6.0.23; = 6.0.24; = 6.0.25; = 6.0.26; = 6.0.27; = 6.0.28; = 6.0.29; = 6.0.30; = 6.0.31; = 6.0.32; = 6.0.33; = 6.0.34; = 6.0.35; = 6.0.36; = 6.0.37; = 6.0.38; = 6.0.39; = 6.0.40; = 6.0.41; = 6.0.42; = 6.0.43; = 6.0.44; = 6.0.45; = 6.0.46; = 6.0.47; = 6.0.48; = 6.0.49; = 6.0.50; = 6.0.51; = 6.0.52; = 7.0.0; = 7.0.1; = 7.0.2; = 7.0.3; = 7.0.4; = 7.0.5; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.52; = 7.0.53; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 7.0.76; = 8.0.0; = 8.0.0-rc1; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.8; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.0.42; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12; >= 8.0.0.RC1, <= 8.0.42; >= 7.0.0, <= 7.0.76; >= 6.0.0, <= 6.0.52), Snyk (>= 7.0.0, < 7.0.77; >= 8, < 8.0.43; >= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 7.0.0, < 7.0.77; >= 8.0.0-RC1, < 8.0.43; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19).", "justification": "code_not_present" } }, { "id": "CVE-2017-5650", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.13-tuxcare.4" } ], "bom-ref": "urn:uuid:3b958693-9526-5aed-a19b-e82032944d32", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-5650 does not affect version 9.0.13-tuxcare.4 of org.apache.tomcat:tomcat. Target version Tomcat 9.0.13 is not affected by CVE-2017-5650. The vulnerability affected Tomcat 9.0.0.M1 through 9.0.0.M18 (milestone releases) and 8.5.0 through 8.5.12. The fix was committed upstream by Mark Thomas in March 2017 and was already present in the Tomcat 9.0.13 release when TuxCare onboarded it. The target contains both fix components: (1) goaway() method calls close() to handle GOAWAY frames, and (2) close() method iterates through all streams and resets them via stream.receiveReset(Http2Error.CANCEL.getCode()), preventing thread exhaustion from streams waiting indefinitely for WINDOW_UPDATE frames.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M19; >= 8.5.0, < 8.5.13), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M18; >= 8.5.0, <= 8.5.12), Snyk (>= 8.5.0, < 8.5.13; >= 9-alpha, < 9.0.0.M19; >= 8.5.0, < 8.5.13; >= 9.0.0.M1, < 9.0.0.M19).", "justification": "code_not_present" } }, { "id": "CVE-2017-5664", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.13-tuxcare.4" } ], "bom-ref": "urn:uuid:87fdcdc7-6cda-5bea-af7c-b5ae5c24e4ea", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-5664 does not affect version 9.0.13-tuxcare.4 of org.apache.tomcat:tomcat. CVE-2017-5664 is not present in Tomcat 9.0.13. The vulnerability affected Tomcat 9.0.0.M1 through 9.0.0.M20, but the fix (commit 7d93527254d9) was applied to the upstream trunk in May 2017 and was included in the upstream 9.0.13 release. The target repository contains the complete fix in both DefaultServlet and WebdavServlet, where error dispatches are forced to use doGet() regardless of the original HTTP method, preventing unintended write operations on static error pages.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M21; >= 8.5.0, < 8.5.15; >= 8.0.0, < 8.0.44; >= 7.0.0, < 7.0.78), NVD (= 7.0.0; = 7.0.0-beta; = 7.0.1; = 7.0.2; = 7.0.2-beta; = 7.0.3; = 7.0.4; = 7.0.4-beta; = 7.0.5; = 7.0.5-beta; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 7.0.76; = 7.0.77; = 8.0.0-rc1; = 8.0.0-rc10; = 8.0.0-rc3; = 8.0.0-rc5; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.0.42; = 8.0.43; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 8.5.13; = 8.5.14; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M20; >= 8.5.0, <= 8.5.14; >= 8.0.0.RC1, <= 8.0.43; >= 7.0.0, <= 7.0.77), Snyk (>= 7.0.0, < 7.0.78; >= 8.0.0RC1, < 8.0.44; >= 8.5.0, < 8.5.15; >= 9.0.0.M1, < 9.0.0.M21; >= 7.0.0, < 7.0.78; >= 8.0.0RC1, < 8.0.44; >= 8.5.0, < 8.5.15; >= 9.0.0.M1, < 9.0.0.M21).", "justification": "code_not_present" } }, { "id": "CVE-2017-7674", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.13-tuxcare.4" } ], "bom-ref": "urn:uuid:a6484573-de49-5a4d-be8a-20d05af51a21", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-7674 does not affect version 9.0.13-tuxcare.4 of org.apache.tomcat:tomcat. The upstream fix was released in 9.0.0.M22, and version 9.0.13 is a later release of the same line. Advisories: GitHub GHSA-73rx-3f9r-x949 (fixed in 9.0.0.M22), NVD (last affected 9.0.0-milestone21), CVE record (last affected 9.0.0.M21).", "justification": "code_not_present" } }, { "id": "CVE-2017-7675", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.13-tuxcare.4" } ], "bom-ref": "urn:uuid:23e8158c-7148-5e39-995c-b3071d10d87d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-7675 does not affect version 9.0.13-tuxcare.4 of org.apache.tomcat:tomcat. CVE-2017-7675 is NOT present in the target. The vulnerability (HTTP/2 implementation ignoring path parameters during security constraint evaluation) was fixed in upstream Apache Tomcat by commit cf181edc9a (Bug 61120, May 2017). This fix was already present in Tomcat 9.0.13 when TuxCare onboarded it (commit deb49d19f6, \"Onboard version 9.0.13\"). The target code correctly sets the URI as bytes (line 335: coyoteRequest.requestURI().setBytes()) rather than as String, ensuring path parameters are parsed and security constraints are properly enforced. This is an upstream vendor fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M22; >= 8.5.0, < 8.5.16), NVD (= 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 8.5.12; = 8.5.13; = 8.5.14; = 8.5.15; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M21; >= 8.5.0, <= 8.5.15), Snyk (>= 8.5.0, < 8.5.16; >= 9.0.0.M1, < 9.0.0.M22; >= 8.5.0, < 8.5.16; >= 9.0.0.M1, < 9.0.0.M22).", "justification": "code_not_present" } }, { "id": "CVE-2019-0221", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.13-tuxcare.4" } ], "bom-ref": "urn:uuid:9117833c-a535-5509-859f-f0cf24255817", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-0221 is fixed in version 9.0.13-tuxcare.4 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2019-17569", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.13-tuxcare.4" } ], "bom-ref": "urn:uuid:8db9f426-ef1c-50cd-9dc9-a71f880f5ed8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-17569 does not affect version 9.0.13-tuxcare.4 of org.apache.tomcat:tomcat. not_affected \u2014 Apache Tomcat 9.0.13 is NOT affected by CVE-2019-17569. This version predates the regression that was introduced in version 9.0.28. The target uses a different, older implementation for parsing Transfer-Encoding headers that rejects invalid/unrecognized encodings with a 501 error, rather than silently ignoring them as the vulnerable versions (9.0.28-9.0.30) did. The vulnerable code pattern invo...", "justification": "code_not_present" } }, { "id": "CVE-2020-11996", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.13-tuxcare.4" } ], "bom-ref": "urn:uuid:783f86b7-30c2-573b-b9e8-2b7a50b47f2d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-11996 affects version 9.0.13-tuxcare.4 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2020-13934", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.13-tuxcare.4" } ], "bom-ref": "urn:uuid:416bae16-130c-5c62-aa55-c8fc9ec553c0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-13934 affects version 9.0.13-tuxcare.4 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2020-13935", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.13-tuxcare.4" } ], "bom-ref": "urn:uuid:62fa638c-2236-5001-b329-e8ff821a9d66", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-13935 is fixed in version 9.0.13-tuxcare.4 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2020-1935", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.13-tuxcare.4" } ], "bom-ref": "urn:uuid:461b0c57-ab94-5406-8789-3b5b727f901b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-1935 affects version 9.0.13-tuxcare.4 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2020-8022", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.13-tuxcare.4" } ], "bom-ref": "urn:uuid:673b571a-2c86-5dde-9809-504ab8e88084", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2020-8022 is a false positive for org.apache.tomcat:tomcat 9.0.13-tuxcare.4." } }, { "id": "CVE-2021-30639", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.13-tuxcare.4" } ], "bom-ref": "urn:uuid:192f18c2-4afd-5a77-bba1-35b02cd2f095", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-30639 does not affect version 9.0.13-tuxcare.4 of org.apache.tomcat:tomcat. CVE-2021-30639 affects Apache Tomcat versions where the errorException field was introduced as part of non-blocking I/O error handling improvements: 10.0.3-10.0.4, 9.0.44, and 8.5.64. The target version 9.0.13 predates the introduction of the errorException field (which first appeared in 9.0.44 for the 9.0.x series) and therefore cannot exhibit the vulnerability. The vulnerability pattern - failure to clear errorException in the recycle() method causing subsequent requests to fail - is absent because the errorException field does not exist in this version.", "justification": "code_not_present" } }, { "id": "CVE-2021-30640", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.13-tuxcare.4" } ], "bom-ref": "urn:uuid:55e51f49-df73-5371-a8ba-729855de25b0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-30640 affects version 9.0.13-tuxcare.4 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2021-33037", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.13-tuxcare.4" } ], "bom-ref": "urn:uuid:f68558ef-a70e-57c2-bca0-d720513e519f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-33037 is fixed in version 9.0.13-tuxcare.4 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2021-41079", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.13-tuxcare.4" } ], "bom-ref": "urn:uuid:cb43b53b-13bf-5d06-8ee5-e0fdb4ca822a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-41079 affects version 9.0.13-tuxcare.4 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2021-42340", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.13-tuxcare.4" } ], "bom-ref": "urn:uuid:103c4eb6-1bfc-5775-a72a-1bbbf6f0e135", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-42340 does not affect version 9.0.13-tuxcare.4 of org.apache.tomcat:tomcat. Tomcat 9.0.13 is NOT AFFECTED by CVE-2021-42340. The vulnerability was introduced by bug 63362 (committed 2020-10-15), which added metric collection infrastructure (UpgradeInfo/UpgradeGroupInfo classes) for HTTP upgrade connections. These classes do not exist in 9.0.13 (released 2018-11-02), therefore the memory leak cannot occur. The CVE's stated version range (9.0.40 to 9.0.53) correctly excludes 9.0.13, which predates the vulnerability-introducing code by nearly 2 years.", "justification": "code_not_present" } }, { "id": "CVE-2021-43980", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.13-tuxcare.4" } ], "bom-ref": "urn:uuid:f5b8426f-dcbf-5eb8-99cf-db543f60a347", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-43980 does not affect version 9.0.13-tuxcare.4 of org.apache.tomcat:tomcat. not_affected \u2014 Version 9.0.13 is not affected by CVE-2021-43980. The vulnerability exists in the `currentProcessor` field mechanism introduced in Tomcat 9.0.28 (October 2019). Version 9.0.13 uses an older architecture where processors are stored in a `connections` ConcurrentHashMap without the `currentProcessor` field. The patch specifically addresses race conditions in the currentProcessor field by changing ...", "justification": "code_not_present" } }, { "id": "CVE-2022-23181", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.13-tuxcare.4" } ], "bom-ref": "urn:uuid:0ea754d8-2c44-5778-af0e-b7cb470bd40c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-23181 is fixed in version 9.0.13-tuxcare.4 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2022-25762", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.13-tuxcare.4" } ], "bom-ref": "urn:uuid:1678c73a-747f-55e3-9399-a53740f51694", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-25762 affects version 9.0.13-tuxcare.4 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2022-29885", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.13-tuxcare.4" } ], "bom-ref": "urn:uuid:1b79cc77-716b-5c9f-a2a4-12806883710d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-29885 does not affect version 9.0.13-tuxcare.4 of org.apache.tomcat:tomcat. The target Apache Tomcat 9.0.13 is NOT AFFECTED by CVE-2022-29885. The vulnerability concerns misleading documentation that suggested EncryptInterceptor enables safe Tomcat clustering on untrusted networks (when it only provides confidentiality/integrity, not DoS protection). However, version 9.0.13 (released 2018-11-02) never contained this misleading documentation. The vulnerable documentation pattern was added to upstream Tomcat on 2019-01-30 (3 months after 9.0.13's release) and first appeared in version ~9.0.16. The target's documentation correctly states that clustering requires trusted networks and lists only appropriate security options (private LAN, VPN, IPSEC) without suggesting EncryptInterceptor as a solution for untrusted networks. The CVE metadata stating \"9.0.13 to 9.0.62\" is technically inaccurate regarding the actual 9.0.13 release.", "justification": "code_not_present" } }, { "id": "CVE-2022-34305", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.13-tuxcare.4" } ], "bom-ref": "urn:uuid:f3a66dce-eb75-539a-883c-98217caf3978", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-34305 does not affect version 9.0.13-tuxcare.4 of org.apache.tomcat:tomcat. not_affected \u2014 Apache Tomcat 9.0.13 is not affected by CVE-2022-34305. The vulnerable code pattern (displaying session attributes and Principal attributes without HTML filtering) does not exist in this version. The affected feature was introduced in Tomcat 9.0.30+, and version 9.0.13 predates this functionality. The file webapps/examples/jsp/security/protected/index.jsp in 9.0.13 is only 82 lines and displays...", "justification": "code_not_present" } }, { "id": "CVE-2023-41080", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.13-tuxcare.4" } ], "bom-ref": "urn:uuid:942ca0d0-144e-5646-bf2a-a20a864dc282", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-41080 is fixed in version 9.0.13-tuxcare.4 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2023-42795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.13-tuxcare.4" } ], "bom-ref": "urn:uuid:09c3774e-ef5e-5441-8a94-eab42641109d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-42795 is fixed in version 9.0.13-tuxcare.4 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2023-45648", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.13-tuxcare.4" } ], "bom-ref": "urn:uuid:8a06f5d0-6c4b-57cb-befd-a03f7297e1eb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-45648 affects version 9.0.13-tuxcare.4 of org.apache.tomcat:tomcat, and is fixed in 9.0.13-tuxcare.6." } }, { "id": "CVE-2024-54677", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.13-tuxcare.4" } ], "bom-ref": "urn:uuid:fd38801b-bde3-525d-bd94-aacf6304e5e5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-54677 is fixed in version 9.0.13-tuxcare.4 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2025-49124", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.13-tuxcare.4" } ], "bom-ref": "urn:uuid:e4a11919-24f3-5b83-b24c-02a1886ef2e4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-49124 does not affect version 9.0.13-tuxcare.4 of org.apache.tomcat:tomcat. Prechecker: The scan of this version produced no finding. The advisories list this line as affected from 9.0.23, and version 9.0.13 is older. Advisories: GitHub GHSA-42wg-hm62-jcwg (affected from 9.0.23), NVD (affected from 9.0.23), CVE record (affected from 9.0.23), Snyk (affected from 9.0.23).", "justification": "code_not_present" } }, { "id": "CVE-2025-55752", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.13-tuxcare.4" } ], "bom-ref": "urn:uuid:15ed40f0-67f3-5b6b-8110-2e624a89e326", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-55752 is fixed in version 9.0.13-tuxcare.4 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2025-55754", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.13-tuxcare.4" } ], "bom-ref": "urn:uuid:e6ed7dff-a556-50be-a31e-9049e1fb2797", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55754 affects version 9.0.13-tuxcare.4 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2025-61795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.13-tuxcare.4" } ], "bom-ref": "urn:uuid:427c6439-e5a1-56d5-8d92-6dbfd952e296", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-61795 is fixed in version 9.0.13-tuxcare.4 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2025-66614", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.13-tuxcare.4" } ], "bom-ref": "urn:uuid:6595aca5-e6a1-55df-9d4c-cb8326c97502", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66614 is fixed in version 9.0.13-tuxcare.4 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-25854", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.13-tuxcare.4" } ], "bom-ref": "urn:uuid:5a2c067b-665f-5a94-a173-f636eb98be6e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25854 is fixed in version 9.0.13-tuxcare.4 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-29129", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.13-tuxcare.4" } ], "bom-ref": "urn:uuid:8271cf09-a78b-5c21-8aca-a0849cf8e282", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-29129 does not affect version 9.0.13-tuxcare.4 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2026-29129 affects Apache Tomcat versions with TLS 1.3 cipher suite configuration support, where a HashSet was used instead of LinkedHashSet in getJsseCipherNames(), causing the configured cipher preference order to be lost when combining TLS 1.3 and legacy cipher lists. Version 9.0.13 predates the TLS 1.3 cipher suite feature entirely (introduced in commit 4ee45c5571 on Jan 6, 2026) and us...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-29145", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.13-tuxcare.4" } ], "bom-ref": "urn:uuid:251289ca-376a-508d-8c81-fb74d2740c06", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-29145 affects version 9.0.13-tuxcare.4 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-29146", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.13-tuxcare.4" } ], "bom-ref": "urn:uuid:3e29372d-c0af-537c-9cfc-595a139b2863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29146 is fixed in version 9.0.13-tuxcare.4 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-32990", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.13-tuxcare.4" } ], "bom-ref": "urn:uuid:d75044d2-efaa-53ea-95b8-84fb8a40bfab", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-32990 affects version 9.0.13-tuxcare.4 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-34483", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.13-tuxcare.4" } ], "bom-ref": "urn:uuid:b3d7f690-b27c-53c4-b52b-699e06c96a65", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34483 affects version 9.0.13-tuxcare.4 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-34486", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.13-tuxcare.4" } ], "bom-ref": "urn:uuid:0cf61fc3-5383-53f7-8974-afa9b007dc59", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34486 affects version 9.0.13-tuxcare.4 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-34487", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.13-tuxcare.4" } ], "bom-ref": "urn:uuid:c733a08b-8b94-558b-b5e8-bd574e9210ee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34487 affects version 9.0.13-tuxcare.4 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-41284", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.13-tuxcare.4" } ], "bom-ref": "urn:uuid:e543d17d-6a8f-5f5b-a4c2-8eb76ea34153", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41284 affects version 9.0.13-tuxcare.4 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-41293", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.13-tuxcare.4" } ], "bom-ref": "urn:uuid:98bb5420-8623-5d88-9f3f-323f9b6b5998", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41293 affects version 9.0.13-tuxcare.4 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-42498", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.13-tuxcare.4" } ], "bom-ref": "urn:uuid:8adb3725-a571-5683-8480-bafbdd67c35b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42498 affects version 9.0.13-tuxcare.4 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-43512", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.13-tuxcare.4" } ], "bom-ref": "urn:uuid:3a1e024d-b125-5111-b1f9-cad8f5be62de", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43512 affects version 9.0.13-tuxcare.4 of org.apache.tomcat:tomcat, and is fixed in 9.0.13-tuxcare.5." } }, { "id": "CVE-2026-43513", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.13-tuxcare.4" } ], "bom-ref": "urn:uuid:727a9be6-2c58-5ac7-bde6-18e95bea71b3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43513 affects version 9.0.13-tuxcare.4 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-43514", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.13-tuxcare.4" } ], "bom-ref": "urn:uuid:2df09c40-fbae-5837-9dca-2c4b1ea2e1a4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43514 affects version 9.0.13-tuxcare.4 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-43515", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.13-tuxcare.4" } ], "bom-ref": "urn:uuid:8d303bfa-2588-5781-b306-3b6908c2d363", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43515 affects version 9.0.13-tuxcare.4 of org.apache.tomcat:tomcat, and is fixed in 9.0.13-tuxcare.5." } }, { "id": "CVE-2026-50229", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.13-tuxcare.4" } ], "bom-ref": "urn:uuid:92fbe8e3-d18f-5d2e-80bf-b9396f51f1af", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50229 affects version 9.0.13-tuxcare.4 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-53404", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.13-tuxcare.4" } ], "bom-ref": "urn:uuid:5f0687e2-888c-5e1c-9b57-683553996ea0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53404 affects version 9.0.13-tuxcare.4 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-55276", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.13-tuxcare.4" } ], "bom-ref": "urn:uuid:186b1868-4035-51ac-92e0-8a8d2aa6e932", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-55276 affects version 9.0.13-tuxcare.4 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-55955", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.13-tuxcare.4" } ], "bom-ref": "urn:uuid:da23a482-703c-5fd4-a72a-c55924a961b4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-55955 affects version 9.0.13-tuxcare.4 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-55956", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.13-tuxcare.4" } ], "bom-ref": "urn:uuid:88fb37cc-f8c5-5a15-a9dc-b4e18fc5b7a2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-55956 affects version 9.0.13-tuxcare.4 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-55957", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.13-tuxcare.4" } ], "bom-ref": "urn:uuid:850bd451-04d4-51b4-a5ce-e8ab9feb051a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-55957 affects version 9.0.13-tuxcare.4 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-65182", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.13-tuxcare.4" } ], "bom-ref": "urn:uuid:8d45eabb-52c7-5871-b560-9cee51acd430", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65182 affects version 9.0.13-tuxcare.4 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-65905", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.13-tuxcare.4" } ], "bom-ref": "urn:uuid:08a1da76-cac1-5306-bbaa-ec62b11eb0ab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65905 is fixed in version 9.0.13-tuxcare.4 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-68525", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.13-tuxcare.4" } ], "bom-ref": "urn:uuid:334506bf-2794-55a5-a267-fa2fb49ea9ea", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-68525 affects version 9.0.13-tuxcare.4 of org.apache.tomcat:tomcat." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@9.0.13-tuxcare.4" } ] }