{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:238900ab-27c2-5ba6-9cc3-47a45a49aa2c",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "protobuf-java",
      "purl": "pkg:maven/com.google.protobuf/protobuf-java@3.21.9-tuxcare.3",
      "type": "library",
      "group": "com.google.protobuf",
      "bom-ref": "pkg:maven/com.google.protobuf/protobuf-java@3.21.9-tuxcare.3",
      "version": "3.21.9-tuxcare.3",
      "pedigree": {
        "ancestors": [
          {
            "name": "protobuf-java",
            "purl": "pkg:maven/com.google.protobuf/protobuf-java@3.21.9",
            "type": "library",
            "group": "com.google.protobuf",
            "version": "3.21.9"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2021-22569",
      "affects": [
        {
          "ref": "pkg:maven/com.google.protobuf/protobuf-java@3.21.9-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:d068fc05-ad37-56ae-94f6-094aff2f33c7",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-22569 does not affect version 3.21.9-tuxcare.3 of com.google.protobuf:protobuf-java. The target protobuf version 3.21.9 is NOT affected by CVE-2021-22569. The vulnerability (DoS via excessive GC pauses when parsing alternating unknown field numbers) was fixed in the upstream release before TuxCare onboarded it. The target contains the fixed implementation using TreeMap-based field builder storage, eliminating the object allocation thrashing that caused the vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.16.1; >= 3.18.0, < 3.18.2; >= 3.19.0, < 3.19.2; >= 3.18.0, < 3.18.2; >= 3.19.0, < 3.19.2), NVD (< 3.19.2; < 3.16.1; >= 3.18.0, < 3.18.2; >= 3.19.0, < 3.19.2; < 3.18.2; >= 3.19.0, < 3.19.2), cve.org (< 3.16.1; < 3.18.2; < 3.19.2; < 3.18.2; < 3.19.2; < 3.19.2), Snyk (< 3.16.1; >= 3.17.0, < 3.18.2; >= 3.19.0, < 3.19.2; < 3.18.2; >= 3.19.0, < 3.19.2).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-22570",
      "affects": [
        {
          "ref": "pkg:maven/com.google.protobuf/protobuf-java@3.21.9-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:dc6f34d8-6334-581b-bedb-0f32998f8956",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2021-22570 is a false positive for com.google.protobuf:protobuf-java 3.21.9-tuxcare.3."
      }
    },
    {
      "id": "CVE-2022-3171",
      "affects": [
        {
          "ref": "pkg:maven/com.google.protobuf/protobuf-java@3.21.9-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:b07a8632-7836-5200-a1a5-2104bda1e6c5",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-3171 does not affect version 3.21.9-tuxcare.3 of com.google.protobuf:protobuf-java. not_affected \u2014 The target repository (protobuf version 3.21.9) is NOT affected by CVE-2022-3171. The vulnerability was fixed in upstream protobuf 3.21.7 (released 2022-09-27) and the fix was already present in the 3.21.9 release that TuxCare onboarded on 2026-05-06. The fix commit (3b5301c11) is authored by upstream developer Mike Kruskal, not TuxCare. The vulnerable parsing pattern (creating new message inst...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-3509",
      "affects": [
        {
          "ref": "pkg:maven/com.google.protobuf/protobuf-java@3.21.9-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:d5379a5e-c5e3-5d9c-9750-65081abeb4d2",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-3509 does not affect version 3.21.9-tuxcare.3 of com.google.protobuf:protobuf-java. Target version 3.21.9 is not affected by CVE-2022-3509. The fix for this TextFormat parser vulnerability was included in upstream protobuf version 3.21.7 (released 2022-09-29) and is present in the target version 3.21.9 (released 2022-10-26). The vulnerable code pattern (creating new builders and repeatedly converting between mutable/immutable forms) has been replaced with builder reuse logic. Fix commit a3888f53317a8018e7a439bac4abeb8f3425d5e9 authored by upstream (mkruskal-google) is an ancestor of HEAD and was part of the upstream release onboarded by TuxCare.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.0.0, < 3.16.3; >= 3.17.0, < 3.19.6; >= 3.20.0, < 3.20.3; >= 3.21.0, < 3.21.7; >= 3.20.0, < 3.20.3; >= 3.21.0, < 3.21.7; >= 3.0.0, < 3.16.3), NVD (>= 3.16.0, < 3.16.3; >= 3.19.0, < 3.19.6; >= 3.20.0, < 3.20.3; >= 3.21.0, < 3.21.7; >= 3.16.0, < 3.16.3; >= 3.17.0, < 3.19.6; >= 3.20.0, < 3.20.3; >= 3.21.0, < 3.21.7), Snyk (< 3.16.3; >= 3.17.0, < 3.19.6; >= 3.20.0, < 3.20.3; >= 3.21.0, < 3.21.7; < 3.16.3; >= 3.17.0, < 3.19.6; >= 3.20.0, < 3.20.3; >= 3.21.0, < 3.21.7).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-3510",
      "affects": [
        {
          "ref": "pkg:maven/com.google.protobuf/protobuf-java@3.21.9-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:629728cf-eb13-5bd5-9a1b-f77bec49704b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-3510 does not affect version 3.21.9-tuxcare.3 of com.google.protobuf:protobuf-java. The target protobuf-java 3.21.9 is NOT vulnerable to CVE-2022-3510. The fixes for this CVE were already included in the upstream 3.21.9 release that TuxCare onboarded. The vulnerability affected versions prior to 3.21.7, and the target version 3.21.9 (released 2022-10-26) already contains the upstream fixes from version 3.21.7 (released 2022-09-27). Both fix commits (3b5301c11 and a3888f53) are present in the target code and were authored by upstream Google developers, not backported by TuxCare.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.0.0, < 3.16.3; >= 3.17.0, < 3.19.6; >= 3.20.0, < 3.20.3; >= 3.21.0, < 3.21.7; >= 3.0.0, < 3.16.3; >= 3.17.0, < 3.19.6; >= 3.20.0, < 3.20.3; >= 3.21.0, < 3.21.7), NVD (>= 3.16.0, < 3.16.3; >= 3.19.0, < 3.19.6; >= 3.20.0, < 3.20.3; >= 3.21.0, < 3.21.7; >= 3.16.0, < 3.16.3; >= 3.17.0, < 3.19.6; >= 3.20.0, < 3.20.3; >= 3.21.0, < 3.21.7), Snyk (>= 3.16.0, < 3.16.3; >= 3.19.0-rc-1, < 3.19.6; >= 3.20.0-rc-1, < 3.20.3; >= 3.21.0-rc-1, < 3.21.7).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-7254",
      "affects": [
        {
          "ref": "pkg:maven/com.google.protobuf/protobuf-java@3.21.9-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:0c14a62f-ca51-579c-8918-d8c0f23da0d7",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-7254 is fixed in version 3.21.9-tuxcare.3 of com.google.protobuf:protobuf-java."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/com.google.protobuf/protobuf-java@3.21.9-tuxcare.3"
    }
  ]
}