{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:0e5166bc-bb17-5914-8fba-c1de11289dc4",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "vertx-web",
      "purl": "pkg:maven/io.vertx/vertx-web@4.2.4-tuxcare.1",
      "type": "library",
      "group": "io.vertx",
      "bom-ref": "pkg:maven/io.vertx/vertx-web@4.2.4-tuxcare.1",
      "version": "4.2.4-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "vertx-web",
            "purl": "pkg:maven/io.vertx/vertx-web@4.2.4",
            "type": "library",
            "group": "io.vertx",
            "version": "4.2.4"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-12540",
      "affects": [
        {
          "ref": "pkg:maven/io.vertx/vertx-web@4.2.4-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:5651ea61-641b-5788-b3e5-172f94fd4b6f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-12540 does not affect version 4.2.4-tuxcare.1 of io.vertx:vertx-web. not_affected \u2014 CVE-2018-12540 is NOT present in target version 4.2.4. The vulnerability (missing validation that CSRF cookie matches header/form token, allowing replay attacks) was fixed in upstream commit 98891b1d9 (June 2018) by Bernard Wagner. The fix validates that the token submitted via HTTP header/form parameter equals the token stored in the cookie (lines 217-221 of CSRFHandlerImpl.java). This fix was...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-12542",
      "affects": [
        {
          "ref": "pkg:maven/io.vertx/vertx-web@4.2.4-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:c84e38a6-8f37-5abc-97e2-b6cd939b6aaa",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-12542 does not affect version 4.2.4-tuxcare.1 of io.vertx:vertx-web. not_affected \u2014 Target version 4.2.4 is NOT affected by CVE-2018-12542. The vulnerable pattern (processing URL paths with backslashes without normalization before path traversal removal) is absent because an upstream fix was already applied in commit d519a0959 (2020-09-28) by Paulo Lopes. The fix normalizes backslashes to forward slashes before removing path traversal sequences, preventing Windows directory tr...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2019-17640",
      "affects": [
        {
          "ref": "pkg:maven/io.vertx/vertx-web@4.2.4-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:3b937d76-2817-57a9-95bd-ba6bf80343d8",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-17640 does not affect version 4.2.4-tuxcare.1 of io.vertx:vertx-web. not_affected \u2014 Target version 4.2.4 is not affected by CVE-2019-17640. The vulnerability (Windows path traversal via backslash characters bypassing webroot restrictions) was fixed in upstream commit d519a0959 by Paulo Lopes on September 28, 2020. This fix was already present in the upstream 4.2.4 release that TuxCare onboarded. The vulnerable code pattern (missing backslash-to-forward-slash conversion before ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-35217",
      "affects": [
        {
          "ref": "pkg:maven/io.vertx/vertx-web@4.2.4-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:4b070491-f115-5eae-b7df-aac04f1b923a",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-35217 does not affect version 4.2.4-tuxcare.1 of io.vertx:vertx-web. not_affected \u2014 The target repository vertx-web version 4.2.4 is not affected by CVE-2020-35217. The vulnerability was a CSRF bypass where validation compared cookie token vs session token, completely ignoring the user-supplied request token. An attacker could perform CSRF attacks without providing any token because session and cookie are auto-sent by browser. The upstream fix by Paulo Lopes (commit e889442011...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-24815",
      "affects": [
        {
          "ref": "pkg:maven/io.vertx/vertx-web@4.2.4-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:6414b65f-50b9-5d22-b1a1-464663b9a751",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-24815 affects version 4.2.4-tuxcare.1 of io.vertx:vertx-web."
      }
    },
    {
      "id": "CVE-2025-11965",
      "affects": [
        {
          "ref": "pkg:maven/io.vertx/vertx-web@4.2.4-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:55bfdc7d-3274-598a-8aaf-0434cd264cb0",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-11965 affects version 4.2.4-tuxcare.1 of io.vertx:vertx-web."
      }
    },
    {
      "id": "CVE-2025-11966",
      "affects": [
        {
          "ref": "pkg:maven/io.vertx/vertx-web@4.2.4-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:bad695e9-ec32-5109-be59-c44933521e16",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-11966 affects version 4.2.4-tuxcare.1 of io.vertx:vertx-web."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/io.vertx/vertx-web@4.2.4-tuxcare.1"
    }
  ]
}