{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:a448cb7a-caca-579b-a3b7-b657526dc307",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "bcel",
      "purl": "pkg:maven/org.apache.bcel/bcel@6.7.0-tuxcare.1",
      "type": "library",
      "group": "org.apache.bcel",
      "bom-ref": "pkg:maven/org.apache.bcel/bcel@6.7.0-tuxcare.1",
      "version": "6.7.0-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "bcel",
            "purl": "pkg:maven/org.apache.bcel/bcel@6.7.0",
            "type": "library",
            "group": "org.apache.bcel",
            "version": "6.7.0"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2022-42920",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.bcel/bcel@6.7.0-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:84cb24a1-3d12-52fa-93f1-d8c22ccc38a3",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-42920 does not affect version 6.7.0-tuxcare.1 of org.apache.bcel:bcel. CVE-2022-42920 describes an out-of-bounds writing vulnerability in Apache Commons BCEL where APIs that should only modify specific class characteristics could be exploited to produce arbitrary bytecode by exceeding the JVM constant pool size limit (65535 entries). The target repository is Apache Commons BCEL version 6.7.0-tuxcare.1. The security fix (commit f3267cbc by Richard Atkins, 2022-09-21) was already present in the upstream Apache Commons BCEL 6.7.0 release before TuxCare onboarded it. All three defense points from the patch are present: (1) ConstantPool.dump() caps size at MAX_CP_ENTRIES before serialization, (2) ConstantPoolGen constructor caps initial size at MAX_CP_ENTRIES+1, (3) ConstantPoolGen.adjustSize() throws IllegalStateException when additions would exceed the limit. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 6.6.0), NVD (< 6.6.0), cve.org (< 6.6.0), Snyk (< 6.6.0).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-105111",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.bcel/bcel@6.7.0-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:c2152d01-9979-5175-a5fe-4ee7a86868da",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-105111 affects version 6.7.0-tuxcare.1 of org.apache.bcel:bcel."
      }
    },
    {
      "id": "CVE-2026-94114",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.bcel/bcel@6.7.0-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:856a8425-1435-5cf4-b393-3a8e5b62f695",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-94114 affects version 6.7.0-tuxcare.1 of org.apache.bcel:bcel."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.bcel/bcel@6.7.0-tuxcare.1"
    }
  ]
}