{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:b70c991e-4428-5f04-b838-eb456e1911f9",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "vertx-core",
      "purl": "pkg:maven/io.vertx/vertx-core@4.5.7-tuxcare.2",
      "type": "library",
      "group": "io.vertx",
      "bom-ref": "pkg:maven/io.vertx/vertx-core@4.5.7-tuxcare.2",
      "version": "4.5.7-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "vertx-core",
            "purl": "pkg:maven/io.vertx/vertx-core@4.5.7",
            "type": "library",
            "group": "io.vertx",
            "version": "4.5.7"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-12537",
      "affects": [
        {
          "ref": "pkg:maven/io.vertx/vertx-core@4.5.7-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:d239bc28-b1ec-5aea-81b0-ab7fda974900",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-12537 does not affect version 4.5.7-tuxcare.2 of io.vertx:vertx-core. not_affected \u2014 CVE-2018-12537 affects Eclipse Vert.x versions 3.0 to 3.5.1, where HttpServer response headers and HttpClient request headers do not filter CRLF characters, enabling HTTP header injection attacks. The target version 4.5.7-tuxcare.1 is not affected because the upstream fix was introduced in version 3.6.0 (October 2018) by Julien Viet. The fix implements strict CRLF validation in HttpUtils.valida...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-12541",
      "affects": [
        {
          "ref": "pkg:maven/io.vertx/vertx-core@4.5.7-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:2c30e8c5-92a2-5e4a-aef9-8448c6c54a11",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-12541 does not affect version 4.5.7-tuxcare.2 of io.vertx:vertx-core. not_affected \u2014 CVE-2018-12541 is NOT present in vertx-core 4.5.7. The vulnerability (unbounded buffering of WebSocket upgrade request bodies leading to memory exhaustion) was fixed in upstream commit eebd62c6 on Sep 8, 2020, which added an 8192-byte limit with HTTP 413 response on violation. This fix shipped in the upstream release 4.5.7 before TuxCare onboarded it. The target code at src/main/java/io/vertx/c...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-12544",
      "affects": [
        {
          "ref": "pkg:maven/io.vertx/vertx-core@4.5.7-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:ce3f651e-7f2c-53b3-b1fa-bdce9c6cfd94",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-12544 does not affect version 4.5.7-tuxcare.2 of io.vertx:vertx-core. not_affected \u2014 CVE-2018-12544 affects the Eclipse Vert.x OpenAPI XML type validator component, which creates XML parsers without proper defenses against XXE and XML bomb attacks. However, this vulnerability is NOT present in vertx-core because the OpenAPI XML type validator functionality does not exist in this module. The OpenAPI functionality is part of a separate Maven module (vertx-web-api-contract), not v...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-1023",
      "affects": [
        {
          "ref": "pkg:maven/io.vertx/vertx-core@4.5.7-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:46a3a861-4878-51d5-8fae-5156ffd7c8d2",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-1023 does not affect version 4.5.7-tuxcare.2 of io.vertx:vertx-core. not_affected \u2014 CVE-2024-1023 describes a memory leak in Eclipse Vert.x caused by instance FastThreadLocal fields in the CombinerExecutor class. Each HTTP client connection to a different host creates a new endpoint with a SimpleConnectionPool, which instantiates a CombinerExecutor. The vulnerable pattern used instance-level FastThreadLocal (line 36 in vulnerable version: `private final FastThreadLocal<InProgr...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-1300",
      "affects": [
        {
          "ref": "pkg:maven/io.vertx/vertx-core@4.5.7-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:3638666e-e8a1-5045-92f0-60eb80f39a5e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-1300 does not affect version 4.5.7-tuxcare.2 of io.vertx:vertx-core. not_affected \u2014 CVE-2024-1300 is NOT present in vertx-core 4.5.7-tuxcare.1. The fix preventing memory exhaustion from unbounded SNI server name map growth was already included in the upstream Vert.x 4.5.7 release. The vulnerable pattern (storing all SNI names in sslContextMaps without validation) does not exist in the target. The defense code (checking if kmf/trustManagers resolve before map storage) is presen...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-1002",
      "affects": [
        {
          "ref": "pkg:maven/io.vertx/vertx-core@4.5.7-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:16cd3f89-c656-5ad7-b2f8-78f937cc3dac",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-1002 affects version 4.5.7-tuxcare.2 of io.vertx:vertx-core."
      }
    },
    {
      "id": "CVE-2026-6860",
      "affects": [
        {
          "ref": "pkg:maven/io.vertx/vertx-core@4.5.7-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:934092e3-07eb-5b1c-89e1-dd58b64535b6",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-6860 affects version 4.5.7-tuxcare.2 of io.vertx:vertx-core."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/io.vertx/vertx-core@4.5.7-tuxcare.2"
    }
  ]
}