{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:a756fb57-2f8c-5209-8793-ca043d010716",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "jmx_prometheus_httpserver",
      "purl": "pkg:maven/io.prometheus.jmx/jmx_prometheus_httpserver@0.16.1-tuxcare.1",
      "type": "library",
      "group": "io.prometheus.jmx",
      "bom-ref": "pkg:maven/io.prometheus.jmx/jmx_prometheus_httpserver@0.16.1-tuxcare.1",
      "version": "0.16.1-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "jmx_prometheus_httpserver",
            "purl": "pkg:maven/io.prometheus.jmx/jmx_prometheus_httpserver@0.16.1",
            "type": "library",
            "group": "io.prometheus.jmx",
            "version": "0.16.1"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2022-38749",
      "affects": [
        {
          "ref": "pkg:maven/io.prometheus.jmx/jmx_prometheus_httpserver@0.16.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:46acaffe-6d9b-5d48-b592-ae56da30ae3f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-38749 does not affect version 0.16.1-tuxcare.1 of io.prometheus.jmx:jmx_prometheus_httpserver. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because its exporter paths expose no way for attackers to supply YAML to the parser. The HTTP exporter reads its configuration file from startup arguments before starting its server (jmx_prometheus_httpserver/src/main/java/io/prometheus/jmx/WebServer.java:30). Scraping can only reload that same file after its modification time increases (collector/src/main/java/io/prometheus/jmx/JmxCollector.java:112, collector/src/main/java/io/prometheus/jmx/JmxCollector.java:534).",
        "justification": "requires_dependency"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/io.prometheus.jmx/jmx_prometheus_httpserver@0.16.1-tuxcare.1"
    }
  ]
}