{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:5c915ccf-f82e-5f5c-9bfb-5969667eb9ad",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "vertx-core",
      "purl": "pkg:maven/io.vertx/vertx-core@4.3.8-tuxcare.1",
      "type": "library",
      "group": "io.vertx",
      "bom-ref": "pkg:maven/io.vertx/vertx-core@4.3.8-tuxcare.1",
      "version": "4.3.8-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "vertx-core",
            "purl": "pkg:maven/io.vertx/vertx-core@4.3.8",
            "type": "library",
            "group": "io.vertx",
            "version": "4.3.8"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-12537",
      "affects": [
        {
          "ref": "pkg:maven/io.vertx/vertx-core@4.3.8-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:0775b7c3-f5d8-532d-8680-43d5db6542d4",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-12537 does not affect version 4.3.8-tuxcare.1 of io.vertx:vertx-core. not_affected \u2014 CVE-2018-12537 affects Eclipse Vert.x 3.0 to 3.5.1 due to missing CR/LF filtering in HTTP headers, allowing header injection attacks. The target repository (io.vertx:vertx-core version 4.3.8-tuxcare.1) is not affected because the vulnerability was fixed in upstream Vert.x 3.6.0 (October 2018) via commit fa03a8e70 by Julien Viet. The fix introduced HttpUtils.validateHeaderValue() which validates...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-12541",
      "affects": [
        {
          "ref": "pkg:maven/io.vertx/vertx-core@4.3.8-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:f7c60d72-c913-5bd0-a725-12925b108ed2",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-12541 does not affect version 4.3.8-tuxcare.1 of io.vertx:vertx-core. not_affected \u2014 Target version 4.3.8 is not affected by CVE-2018-12541. The vulnerability (unbounded buffering of WebSocket upgrade request bodies leading to memory exhaustion DoS) was fixed in upstream commit eebd62c639 by Julien Viet on 2020-09-08. The fix enforces an 8192-byte limit on request bodies during WebSocket upgrade and returns HTTP 413 for oversized requests, exactly as specified in the CVE. This ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-12544",
      "affects": [
        {
          "ref": "pkg:maven/io.vertx/vertx-core@4.3.8-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:08efd0ab-7e28-5441-80ea-b763e9998fba",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2018-12544 is a false positive for io.vertx:vertx-core 4.3.8-tuxcare.1. false_positive \u2014 CVE-2018-12544 is a wrong-project match. This repository is Eclipse Vert.x Core (vertx-core) version 4.3.8, which provides low-level HTTP, TCP, and file system functionality. The CVE specifically targets the \"Eclipse Vert.x OpenAPI XML type validator\" component, which exists in a separate module (vertx-web-api-contract in 3.x versions, later vertx-web-openapi). Exhaustive containment searches c..."
      }
    },
    {
      "id": "CVE-2024-1023",
      "affects": [
        {
          "ref": "pkg:maven/io.vertx/vertx-core@4.3.8-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:894314cd-57c6-5f8b-8ac8-f9b4f88e0f46",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-1023 does not affect version 4.3.8-tuxcare.1 of io.vertx:vertx-core. Prechecker: no vulnerable code from the patch was found, and this version calls none of the distinctive methods on the lines the fix removes. Advisories: GitHub, cve.org (Red Hat) and Snyk list only 4.4.5, 4.4.6, 4.5.0 and 4.5.1 as affected, so this version is older; NVD gives no range. Confirmed not affected by the Java ELS team review on 2026-11-06.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-1300",
      "affects": [
        {
          "ref": "pkg:maven/io.vertx/vertx-core@4.3.8-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:a1f34e0a-1914-5fe7-8358-7adbe96595a7",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-1300 affects version 4.3.8-tuxcare.1 of io.vertx:vertx-core."
      }
    },
    {
      "id": "CVE-2026-1002",
      "affects": [
        {
          "ref": "pkg:maven/io.vertx/vertx-core@4.3.8-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:9ad96c02-d90b-5636-bc86-9587e9572b32",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-1002 affects version 4.3.8-tuxcare.1 of io.vertx:vertx-core."
      }
    },
    {
      "id": "CVE-2026-6860",
      "affects": [
        {
          "ref": "pkg:maven/io.vertx/vertx-core@4.3.8-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:95fbc4cd-0d51-54ff-a322-4950f1661fcf",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-6860 affects version 4.3.8-tuxcare.1 of io.vertx:vertx-core."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/io.vertx/vertx-core@4.3.8-tuxcare.1"
    }
  ]
}