{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:dbdfa279-ccc4-5aa0-af87-582a503489b8",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "json-smart",
      "purl": "pkg:maven/net.minidev/json-smart@2.3.1-tuxcare.1",
      "type": "library",
      "group": "net.minidev",
      "bom-ref": "pkg:maven/net.minidev/json-smart@2.3.1-tuxcare.1",
      "version": "2.3.1-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "json-smart",
            "purl": "pkg:maven/net.minidev/json-smart@2.3.1",
            "type": "library",
            "group": "net.minidev",
            "version": "2.3.1"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2021-27568",
      "affects": [
        {
          "ref": "pkg:maven/net.minidev/json-smart@2.3.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:a1d3b7a0-87af-5a2f-b8a9-d524bfa59ee2",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-27568 does not affect version 2.3.1-tuxcare.1 of net.minidev:json-smart. not_affected \u2014 CVE-2021-27568 is NOT present in json-smart 2.3.1-tuxcare.1. The vulnerability (uncaught NumberFormatException during JSON number parsing) was fixed in the upstream 2.3.1 release on April 23, 2021 by commit b3d52aa (author: dpeger). All number parsing operations in the target delegate to JSONParserBase.extractFloat() which wraps Float.parseFloat(), Double.parseDouble(), and BigDecimal construct...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-31684",
      "affects": [
        {
          "ref": "pkg:maven/net.minidev/json-smart@2.3.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:aeb6f918-74e7-5547-8e3a-b99d29567e25",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-31684 affects version 2.3.1-tuxcare.1 of net.minidev:json-smart, and is fixed in 2.3.1-tuxcare.2."
      }
    },
    {
      "id": "CVE-2023-1370",
      "affects": [
        {
          "ref": "pkg:maven/net.minidev/json-smart@2.3.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:ca0a7fce-b19a-5bcd-9efb-2d83e3a1e0f4",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2023-1370 is fixed in version 2.3.1-tuxcare.1 of net.minidev:json-smart."
      }
    },
    {
      "id": "CVE-2024-57699",
      "affects": [
        {
          "ref": "pkg:maven/net.minidev/json-smart@2.3.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:1820a665-bdbe-5069-acbf-615bbef6164c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-57699 affects version 2.3.1-tuxcare.1 of net.minidev:json-smart."
      }
    },
    {
      "id": "CVE-2026-113602",
      "affects": [
        {
          "ref": "pkg:maven/net.minidev/json-smart@2.3.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:fe21faac-46cc-5aff-9862-6b96df9031ce",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-113602 affects version 2.3.1-tuxcare.1 of net.minidev:json-smart."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/net.minidev/json-smart@2.3.1-tuxcare.1"
    }
  ]
}