{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:91ad7713-6941-5cc0-aca9-81ab6815e6cf",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "xmlbeans",
      "purl": "pkg:maven/org.apache.xmlbeans/xmlbeans@5.1.1-tuxcare.2",
      "type": "library",
      "group": "org.apache.xmlbeans",
      "bom-ref": "pkg:maven/org.apache.xmlbeans/xmlbeans@5.1.1-tuxcare.2",
      "version": "5.1.1-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "xmlbeans",
            "purl": "pkg:maven/org.apache.xmlbeans/xmlbeans@5.1.1",
            "type": "library",
            "group": "org.apache.xmlbeans",
            "version": "5.1.1"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2021-23926",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.xmlbeans/xmlbeans@5.1.1-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:220ecdd1-0b35-58d6-a342-aaead8fab4af",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-23926 does not affect version 5.1.1-tuxcare.2 of org.apache.xmlbeans:xmlbeans. CVE-2021-23926 (XXE/Entity Expansion) is NOT present in xmlbeans 5.1.1-tuxcare.1. The vulnerability pattern (unconfigured XML parsers lacking XXE protections) has been removed by an upstream Apache fix that shipped in the 5.1.1 release. The target contains DocumentHelper, SAXHelper, and StaxHelper classes with full XXE defenses: FEATURE_SECURE_PROCESSING enabled, entity expansion limit (2048), external entity resolution disabled, DTD processing disabled by default, and ignoring entity resolver. Production code uses these secure helpers (e.g., Locale.java:2232 uses SAXHelper.newXMLReader). No unsafe parser instantiations bypass the helpers. Fix commit 80cb805e by Apache developer fanningpj@apache.org predates TuxCare onboarding (2f1e875c), confirming upstream origin.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.0), NVD (<= 2.6.0), cve.org (<= 2.6.0), Snyk (< 3.0.0).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.xmlbeans/xmlbeans@5.1.1-tuxcare.2"
    }
  ]
}