{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:7b880cd8-d657-5b44-a331-03de591b85bc", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "vertx-core", "purl": "pkg:maven/io.vertx/vertx-core@4.3.4-tuxcare.1", "type": "library", "group": "io.vertx", "bom-ref": "pkg:maven/io.vertx/vertx-core@4.3.4-tuxcare.1", "version": "4.3.4-tuxcare.1", "pedigree": { "ancestors": [ { "name": "vertx-core", "purl": "pkg:maven/io.vertx/vertx-core@4.3.4", "type": "library", "group": "io.vertx", "version": "4.3.4" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2018-12537", "affects": [ { "ref": "pkg:maven/io.vertx/vertx-core@4.3.4-tuxcare.1" } ], "bom-ref": "urn:uuid:e948b249-a300-530b-9cc9-34bcd436ded4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-12537 does not affect version 4.3.4-tuxcare.1 of io.vertx:vertx-core. not_affected \u2014 Target version 4.3.4 is not affected by CVE-2018-12537. The vulnerability (HTTP header injection via unvalidated CR/LF characters) was fixed in upstream commit 1bb6445226c39a95e7d07ce3caaf56828e8aab72 by Julien Viet on 2018-05-23. This fix was already present in the upstream release 4.3.4 when TuxCare onboarded it (1901 commits before the onboarding commit 6df8b541). The target contains compreh...", "justification": "code_not_present" } }, { "id": "CVE-2018-12541", "affects": [ { "ref": "pkg:maven/io.vertx/vertx-core@4.3.4-tuxcare.1" } ], "bom-ref": "urn:uuid:26144eb1-aaa8-518c-81d9-1db253d5930d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-12541 does not affect version 4.3.4-tuxcare.1 of io.vertx:vertx-core. not_affected \u2014 Target version 4.3.4 is NOT vulnerable to CVE-2018-12541. The upstream vendor (Eclipse Vert.x) fixed the unbounded WebSocket upgrade request body buffering vulnerability in commit eebd62c6391105ddd4c725e21277b69e4363da3d, which shipped in the upstream 4.3.4 release before TuxCare onboarded it. The fix implements the exact defense: limits buffered content to 8192 bytes, sends HTTP 413 when excee...", "justification": "code_not_present" } }, { "id": "CVE-2018-12544", "affects": [ { "ref": "pkg:maven/io.vertx/vertx-core@4.3.4-tuxcare.1" } ], "bom-ref": "urn:uuid:3b6a6f9e-6221-5493-b19d-8bce49fe84bc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-12544 does not affect version 4.3.4-tuxcare.1 of io.vertx:vertx-core. not_affected \u2014 CVE-2018-12544 affects the Eclipse Vert.x OpenAPI XML type validator component, which is NOT part of vertx-core. This repository contains only core Vert.x functionality (HTTP, TCP, file system, event bus, buffers) with no OpenAPI code whatsoever. The vulnerable component exists in a separate module (likely vertx-web-api-contract or vertx-web-openapi). Exhaustive searches across 595 Java source ...", "justification": "code_not_present" } }, { "id": "CVE-2024-1023", "affects": [ { "ref": "pkg:maven/io.vertx/vertx-core@4.3.4-tuxcare.1" } ], "bom-ref": "urn:uuid:403f07a2-4edb-5b4b-86f0-c404ce85f627", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-1023 does not affect version 4.3.4-tuxcare.1 of io.vertx:vertx-core. not_affected \u2014 Version 4.3.4 is NOT affected by CVE-2024-1023. The vulnerability pattern (per-instance FastThreadLocal allocation in CombinerExecutor causing unbounded InternalThreadLocalMap growth) does not exist in this version. The vulnerable code was introduced 9 months after 4.3.4's release (September 2022) in version 4.4.5 (June 2023) and fixed in version 4.4.7. Version 4.3.4 uses a simpler CombinerExec...", "justification": "code_not_reachable" } }, { "id": "CVE-2024-1300", "affects": [ { "ref": "pkg:maven/io.vertx/vertx-core@4.3.4-tuxcare.1" } ], "bom-ref": "urn:uuid:405d243c-d790-5eef-92b1-4f41ca1a339f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-1300 affects version 4.3.4-tuxcare.1 of io.vertx:vertx-core." } }, { "id": "CVE-2024-8391", "affects": [ { "ref": "pkg:maven/io.vertx/vertx-core@4.3.4-tuxcare.1" } ], "bom-ref": "urn:uuid:716baaee-9fef-5c79-aac8-682db8f759ac", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2024-8391 is a false positive for io.vertx:vertx-core 4.3.4-tuxcare.1. false_positive \u2014 Wrong-project match: CVE-2024-8391 concerns io.vertx:vertx-grpc-server and io.vertx:vertx-grpc-client, but the target repository is io.vertx:vertx-core version 4.3.4. Exhaustive containment search found no gRPC component code in this repository - no vendored/bundled copy, no dependency relationship. Eclipse Vert.x maintains vertx-grpc as a separate repository. Additionally, the patch modifies I..." } }, { "id": "CVE-2026-1002", "affects": [ { "ref": "pkg:maven/io.vertx/vertx-core@4.3.4-tuxcare.1" } ], "bom-ref": "urn:uuid:1c115177-b231-536c-b918-6f55f78045bb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-1002 affects version 4.3.4-tuxcare.1 of io.vertx:vertx-core." } }, { "id": "CVE-2026-6860", "affects": [ { "ref": "pkg:maven/io.vertx/vertx-core@4.3.4-tuxcare.1" } ], "bom-ref": "urn:uuid:7c19afbf-b8ee-56f9-8202-a7041a2ad80a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-6860 affects version 4.3.4-tuxcare.1 of io.vertx:vertx-core." } } ], "dependencies": [ { "ref": "pkg:maven/io.vertx/vertx-core@4.3.4-tuxcare.1" } ] }