{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:cb6207a7-7ef7-555c-9198-a972b6add41c",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "vertx-core",
      "purl": "pkg:maven/io.vertx/vertx-core@3.6.3-tuxcare.1",
      "type": "library",
      "group": "io.vertx",
      "bom-ref": "pkg:maven/io.vertx/vertx-core@3.6.3-tuxcare.1",
      "version": "3.6.3-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "vertx-core",
            "purl": "pkg:maven/io.vertx/vertx-core@3.6.3",
            "type": "library",
            "group": "io.vertx",
            "version": "3.6.3"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-12537",
      "affects": [
        {
          "ref": "pkg:maven/io.vertx/vertx-core@3.6.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:3c199134-d5e2-54f6-a7ff-b0a0cd990f88",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-12537 affects version 3.6.3-tuxcare.1 of io.vertx:vertx-core."
      }
    },
    {
      "id": "CVE-2018-12541",
      "affects": [
        {
          "ref": "pkg:maven/io.vertx/vertx-core@3.6.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:8ad6e45c-0f46-5e65-a4f8-57c32907f18b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-12541 does not affect version 3.6.3-tuxcare.1 of io.vertx:vertx-core. Prechecker: The method the fix changes and the vulnerable lines are absent from this version. Version 3.6.3 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-45xm-v8gq-7jqx (affected up to 3.5.4), NVD (affected up to 3.5.4), Snyk (affected up to 3.5.4).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-12544",
      "affects": [
        {
          "ref": "pkg:maven/io.vertx/vertx-core@3.6.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:4933beb3-d9ff-5642-ac8e-d7f207b454d7",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-12544 affects version 3.6.3-tuxcare.1 of io.vertx:vertx-core."
      }
    },
    {
      "id": "CVE-2024-1023",
      "affects": [
        {
          "ref": "pkg:maven/io.vertx/vertx-core@3.6.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:56fcb490-f980-550a-be2b-024564c34074",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-1023 does not affect version 3.6.3-tuxcare.1 of io.vertx:vertx-core. Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 3.6.3 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-5667-3wch-7q7w (newer lines only), CVE record (newer lines only), Snyk (newer lines only).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-1300",
      "affects": [
        {
          "ref": "pkg:maven/io.vertx/vertx-core@3.6.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:faf5ebdb-4eb2-57a8-9d38-a041c7a5faea",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-1300 does not affect version 3.6.3-tuxcare.1 of io.vertx:vertx-core. not_affected \u2014 Vert.x 3.6.3 SSLHelper does not cache SslContexts by client-supplied server name. The cache (sslContextMap) is keyed by the certificate of a configured key manager. An unknown SNI name yields no key manager, so the pre-built default context is returned without being stored. Attacker-chosen names therefore cannot grow retained memory without bound, and the CVE-2024-1300 leak (introduced later in...",
        "justification": "code_not_reachable"
      }
    },
    {
      "id": "CVE-2026-1002",
      "affects": [
        {
          "ref": "pkg:maven/io.vertx/vertx-core@3.6.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:9fb062eb-3d7b-5c6b-a0fd-ec688f62a0df",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-1002 does not affect version 3.6.3-tuxcare.1 of io.vertx:vertx-core. not_affected \u2014 Not affected, with moderate confidence. The target (vert.x core 3.6.3) has no Vert.x Web StaticHandler. Its only dot-segment code is HttpUtils.removeDots/normalizePath, which does not decode %2F and handles the CVE-style input (/foo/bar%2F..%2Findex.html) correctly. I could not read the PR 5895 diff, so I compared the target's algorithm with an RFC 3986 \u00a75.2.4 reference. It matched on every inp...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-6860",
      "affects": [
        {
          "ref": "pkg:maven/io.vertx/vertx-core@3.6.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:1c4fbb2a-ca90-500c-894e-5f17fa58850a",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-6860 does not affect version 3.6.3-tuxcare.1 of io.vertx:vertx-core. not_affected \u2014 Target is vert.x 3.6.3 (SSLHelper), older than the affected range 4.3.4-5.0.11. Its server-side SslContext cache is keyed by the matched server Certificate, not by the client-supplied SNI name, so distinct SNI names that match one wildcard entry all map to a single cache entry. Cache size is bounded by the number of certificates in the configured keystore. The CVE's unbounded serverName-keyed c...",
        "justification": "code_not_reachable"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/io.vertx/vertx-core@3.6.3-tuxcare.1"
    }
  ]
}