{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:a9d6a45e-5f2e-59ab-807f-fc7c757287e8", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "async-http-client", "purl": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.2", "type": "library", "group": "org.asynchttpclient", "bom-ref": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.2", "version": "2.12.3-tuxcare.2", "pedigree": { "ancestors": [ { "name": "async-http-client", "purl": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3", "type": "library", "group": "org.asynchttpclient", "version": "2.12.3" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2017-14063", "affects": [ { "ref": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.2" } ], "bom-ref": "urn:uuid:4fdba021-378d-5538-b2a7-333bbee5cf52", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-14063 does not affect version 2.12.3-tuxcare.2 of org.asynchttpclient:async-http-client. The target repository (async-http-client 2.12.3-tuxcare.1) is NOT affected by CVE-2017-14063. The vulnerability, which allowed URL parsing confusion when a '?' character appears in a fragment identifier, was fixed in the upstream release before TuxCare onboarded version 2.12.3. The fix commit (eb9e3347e) authored by Stephane Landelle (slandelle@gatling.io) is present in HEAD and was part of the upstream release 2.12.3 that TuxCare onboarded. The vulnerable code pattern (parsing query before trimming fragment) is not present; the current code correctly trims the fragment before searching for the query delimiter.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.35), NVD (< 2.0.35), Snyk (< 2.0.35; < 2.0.35).", "justification": "code_not_present" } }, { "id": "CVE-2024-53990", "affects": [ { "ref": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.2" } ], "bom-ref": "urn:uuid:3d34f8d1-825c-5310-afcb-c392035326d0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-53990 is fixed in version 2.12.3-tuxcare.2 of org.asynchttpclient:async-http-client." } }, { "id": "CVE-2026-107226", "affects": [ { "ref": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.2" } ], "bom-ref": "urn:uuid:7c6b2ff4-389e-5124-a506-a4844c1ae589", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-107226 is fixed in version 2.12.3-tuxcare.2 of org.asynchttpclient:async-http-client." } }, { "id": "CVE-2026-107227", "affects": [ { "ref": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.2" } ], "bom-ref": "urn:uuid:ad88ddd9-a72a-55cd-b5a9-b5d206103bfa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-107227 is fixed in version 2.12.3-tuxcare.2 of org.asynchttpclient:async-http-client." } }, { "id": "CVE-2026-107228", "affects": [ { "ref": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.2" } ], "bom-ref": "urn:uuid:21c2a608-0302-58dc-98b3-784ef6899004", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-107228 is fixed in version 2.12.3-tuxcare.2 of org.asynchttpclient:async-http-client." } }, { "id": "CVE-2026-107230", "affects": [ { "ref": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.2" } ], "bom-ref": "urn:uuid:f274a128-650a-5197-a41d-9d6d4009bd40", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-107230 is fixed in version 2.12.3-tuxcare.2 of org.asynchttpclient:async-http-client." } }, { "id": "CVE-2026-107231", "affects": [ { "ref": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.2" } ], "bom-ref": "urn:uuid:99b0bc4c-017e-54c9-b911-0c740be94e67", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-107231 is fixed in version 2.12.3-tuxcare.2 of org.asynchttpclient:async-http-client." } }, { "id": "CVE-2026-107280", "affects": [ { "ref": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.2" } ], "bom-ref": "urn:uuid:01ac7c1b-5c7f-5427-91a7-9585f7e2c31f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-107280 is fixed in version 2.12.3-tuxcare.2 of org.asynchttpclient:async-http-client." } }, { "id": "CVE-2026-107282", "affects": [ { "ref": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.2" } ], "bom-ref": "urn:uuid:1cc3b57b-bbec-5101-8b3d-0700e3dc587d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-107282 is fixed in version 2.12.3-tuxcare.2 of org.asynchttpclient:async-http-client." } }, { "id": "CVE-2026-107283", "affects": [ { "ref": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.2" } ], "bom-ref": "urn:uuid:d4a157f7-1dfd-5295-9602-9883fdf2c35b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-107283 is fixed in version 2.12.3-tuxcare.2 of org.asynchttpclient:async-http-client." } }, { "id": "CVE-2026-107285", "affects": [ { "ref": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.2" } ], "bom-ref": "urn:uuid:2ff92f13-aee5-5531-bd52-fa7600b95ffc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-107285 is fixed in version 2.12.3-tuxcare.2 of org.asynchttpclient:async-http-client." } }, { "id": "CVE-2026-40490", "affects": [ { "ref": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.2" } ], "bom-ref": "urn:uuid:1241747d-1d15-5dce-91d0-4521a728cbb5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40490 is fixed in version 2.12.3-tuxcare.2 of org.asynchttpclient:async-http-client." } }, { "id": "CVE-2026-45300", "affects": [ { "ref": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.2" } ], "bom-ref": "urn:uuid:32cde401-6481-5ce3-af0d-ec9c37e6d65a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-45300 is fixed in version 2.12.3-tuxcare.2 of org.asynchttpclient:async-http-client." } }, { "id": "CVE-2026-55688", "affects": [ { "ref": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.2" } ], "bom-ref": "urn:uuid:30507201-85fa-5947-a057-915b2213c0e1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55688 is fixed in version 2.12.3-tuxcare.2 of org.asynchttpclient:async-http-client." } }, { "id": "CVE-2026-85716", "affects": [ { "ref": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.2" } ], "bom-ref": "urn:uuid:def21388-1869-5e80-b9b2-2bbf6dcb9f46", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-85716 does not affect version 2.12.3-tuxcare.2 of org.asynchttpclient:async-http-client. not_affected \u2014 Target version 2.12.3 is NOT affected by CVE-2026-85716. The CVE explicitly excludes the 2.x line, stating \"The 2.x line is not affected either: it has no SCRAM support, and its interceptor chain does not implement Digest mutual authentication, so there is no verification result to act on.\" Code inspection confirms: (1) No SCRAM support - Realm.AuthScheme enum contains only BASIC, DIGEST, NTLM,...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-85717", "affects": [ { "ref": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.2" } ], "bom-ref": "urn:uuid:41092760-1f83-5b43-9da1-8e621cb47666", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-85717 does not affect version 2.12.3-tuxcare.2 of org.asynchttpclient:async-http-client. not_affected \u2014 Version 2.12.3 is NOT affected by CVE-2026-85717. This CVE describes a RESIDUAL vulnerability that bypasses the cross-origin credential strip introduced by GHSA-cmxv-58fp-fm3g. Version 2.12.3 predates that strip mechanism (affected versions: 2.14.5-2.16.0), so the specific bypass chain this CVE addresses cannot occur. The CVE explicitly states: \"Releases below those floors are covered by the ea...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-85720", "affects": [ { "ref": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.2" } ], "bom-ref": "urn:uuid:bf1db791-d94a-56a6-8c41-f94c869a12c8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-85720 is fixed in version 2.12.3-tuxcare.2 of org.asynchttpclient:async-http-client." } }, { "id": "CVE-2026-85721", "affects": [ { "ref": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.2" } ], "bom-ref": "urn:uuid:81e142a0-c84b-5c69-a8e1-f08fdce92e74", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-85721 is fixed in version 2.12.3-tuxcare.2 of org.asynchttpclient:async-http-client." } }, { "id": "GHSA-cmxv-58fp-fm3g", "affects": [ { "ref": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.2" } ], "bom-ref": "urn:uuid:5a03b9ab-7858-52e6-897a-312106b613cf", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cmxv-58fp-fm3g is fixed in version 2.12.3-tuxcare.2 of org.asynchttpclient:async-http-client." } } ], "dependencies": [ { "ref": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.2" } ] }