{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:b4fb3bb1-edd1-5723-a938-6f216a4e1080",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "logback-core",
      "purl": "pkg:maven/ch.qos.logback/logback-core@0.9.18-tuxcare.1",
      "type": "library",
      "group": "ch.qos.logback",
      "bom-ref": "pkg:maven/ch.qos.logback/logback-core@0.9.18-tuxcare.1",
      "version": "0.9.18-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "logback-core",
            "purl": "pkg:maven/ch.qos.logback/logback-core@0.9.18",
            "type": "library",
            "group": "ch.qos.logback",
            "version": "0.9.18"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2017-5929",
      "affects": [
        {
          "ref": "pkg:maven/ch.qos.logback/logback-core@0.9.18-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:5e8e23ae-74b4-5ffc-9a6b-06363f4315a9",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2017-5929 is fixed in version 0.9.18-tuxcare.1 of ch.qos.logback:logback-core."
      }
    },
    {
      "id": "CVE-2021-42550",
      "affects": [
        {
          "ref": "pkg:maven/ch.qos.logback/logback-core@0.9.18-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:802df149-db11-5d2e-9a56-6c3d155b0e84",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-42550 affects version 0.9.18-tuxcare.1 of ch.qos.logback:logback-core."
      }
    },
    {
      "id": "CVE-2023-6378",
      "affects": [
        {
          "ref": "pkg:maven/ch.qos.logback/logback-core@0.9.18-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:8207b238-0110-5b72-922f-ef5741608d61",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-6378 affects version 0.9.18-tuxcare.1 of ch.qos.logback:logback-core."
      }
    },
    {
      "id": "CVE-2023-6481",
      "affects": [
        {
          "ref": "pkg:maven/ch.qos.logback/logback-core@0.9.18-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:b671f99e-7664-5af4-bc35-886ce5d819d1",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-6481 affects version 0.9.18-tuxcare.1 of ch.qos.logback:logback-core."
      }
    },
    {
      "id": "CVE-2024-12798",
      "affects": [
        {
          "ref": "pkg:maven/ch.qos.logback/logback-core@0.9.18-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:e0c22b89-4f52-5c27-8113-ad707bead1f1",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-12798 affects version 0.9.18-tuxcare.1 of ch.qos.logback:logback-core."
      }
    },
    {
      "id": "CVE-2024-12801",
      "affects": [
        {
          "ref": "pkg:maven/ch.qos.logback/logback-core@0.9.18-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:cca5582a-f612-5630-afc5-50beab87dea1",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-12801 is fixed in version 0.9.18-tuxcare.1 of ch.qos.logback:logback-core."
      }
    },
    {
      "id": "CVE-2025-11226",
      "affects": [
        {
          "ref": "pkg:maven/ch.qos.logback/logback-core@0.9.18-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:8daff21e-5bd8-553a-81f5-84650f0871ae",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-11226 affects version 0.9.18-tuxcare.1 of ch.qos.logback:logback-core."
      }
    },
    {
      "id": "CVE-2026-10532",
      "affects": [
        {
          "ref": "pkg:maven/ch.qos.logback/logback-core@0.9.18-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:311dc47b-2ecc-5397-9ef3-a91709183931",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-10532 does not affect version 0.9.18-tuxcare.1 of ch.qos.logback:logback-core. not_affected \u2014 Version 0.9.18 is NOT AFFECTED by CVE-2026-10532. The vulnerability specifically targets HardenedObjectInputStream's class whitelist mechanism, allowing attackers to bypass it by instantiating Proxy objects. However, HardenedObjectInputStream does not exist in version 0.9.18 (introduced in February 2017 as part of CVE-2017-5929 fix, first appearing in version 1.2.0+). Version 0.9.18 predates th...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-1225",
      "affects": [
        {
          "ref": "pkg:maven/ch.qos.logback/logback-core@0.9.18-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:d57ca4b6-550d-5874-818b-d426adcb1a45",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-1225 affects version 0.9.18-tuxcare.1 of ch.qos.logback:logback-core."
      }
    },
    {
      "id": "CVE-2026-9828",
      "affects": [
        {
          "ref": "pkg:maven/ch.qos.logback/logback-core@0.9.18-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:f16c2775-415c-5218-a749-e02625a857ea",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-9828 does not affect version 0.9.18-tuxcare.1 of ch.qos.logback:logback-core. not_affected \u2014 Version 0.9.18 is NOT affected by CVE-2026-9828. The vulnerability is a prefix-matching flaw in HardenedObjectInputStream (allowing arbitrary java.lang/java.util classes via startsWith() check). This component was introduced in version 1.2.0 (2017) as the fix for CVE-2017-5929. Version 0.9.18 (2009) predates HardenedObjectInputStream entirely and uses plain ObjectInputStream. While 0.9.18 has a...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/ch.qos.logback/logback-core@0.9.18-tuxcare.1"
    }
  ]
}