{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:4800d66e-019c-5752-9973-d4321dd7ce94", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "async-http-client", "purl": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.3", "type": "library", "group": "org.asynchttpclient", "bom-ref": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.3", "version": "2.12.3-tuxcare.3", "pedigree": { "ancestors": [ { "name": "async-http-client", "purl": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3", "type": "library", "group": "org.asynchttpclient", "version": "2.12.3" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2017-14063", "affects": [ { "ref": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.3" } ], "bom-ref": "urn:uuid:a99a82fb-af3d-5d80-a1d1-e74e303220f0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-14063 does not affect version 2.12.3-tuxcare.3 of org.asynchttpclient:async-http-client. The target repository (async-http-client 2.12.3-tuxcare.1) is NOT affected by CVE-2017-14063. The vulnerability, which allowed URL parsing confusion when a '?' character appears in a fragment identifier, was fixed in the upstream release before TuxCare onboarded version 2.12.3. The fix commit (eb9e3347e) authored by Stephane Landelle (slandelle@gatling.io) is present in HEAD and was part of the upstream release 2.12.3 that TuxCare onboarded. The vulnerable code pattern (parsing query before trimming fragment) is not present; the current code correctly trims the fragment before searching for the query delimiter.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.35), NVD (< 2.0.35), Snyk (< 2.0.35; < 2.0.35).", "justification": "code_not_present" } }, { "id": "CVE-2024-53990", "affects": [ { "ref": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.3" } ], "bom-ref": "urn:uuid:58956daa-50f1-50b3-8ddb-abef37163631", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-53990 is fixed in version 2.12.3-tuxcare.3 of org.asynchttpclient:async-http-client." } }, { "id": "CVE-2026-107226", "affects": [ { "ref": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.3" } ], "bom-ref": "urn:uuid:49ea3443-22e2-571a-b475-51dc34c11499", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-107226 is fixed in version 2.12.3-tuxcare.3 of org.asynchttpclient:async-http-client." } }, { "id": "CVE-2026-107227", "affects": [ { "ref": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.3" } ], "bom-ref": "urn:uuid:a9ef0ec8-0c9c-5fc0-a7fc-f91a64cadf72", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-107227 is fixed in version 2.12.3-tuxcare.3 of org.asynchttpclient:async-http-client." } }, { "id": "CVE-2026-107228", "affects": [ { "ref": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.3" } ], "bom-ref": "urn:uuid:3faccf77-a394-5409-8f5b-94677643d909", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-107228 is fixed in version 2.12.3-tuxcare.3 of org.asynchttpclient:async-http-client." } }, { "id": "CVE-2026-107230", "affects": [ { "ref": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.3" } ], "bom-ref": "urn:uuid:94f5175b-9c9b-5a43-a64a-d42218b946d4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-107230 is fixed in version 2.12.3-tuxcare.3 of org.asynchttpclient:async-http-client." } }, { "id": "CVE-2026-107231", "affects": [ { "ref": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.3" } ], "bom-ref": "urn:uuid:c828bec9-779b-59f3-b109-503fa5c59c75", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-107231 is fixed in version 2.12.3-tuxcare.3 of org.asynchttpclient:async-http-client." } }, { "id": "CVE-2026-107280", "affects": [ { "ref": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.3" } ], "bom-ref": "urn:uuid:72f2ab9a-129a-5c38-b561-1bf78eec733f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-107280 is fixed in version 2.12.3-tuxcare.3 of org.asynchttpclient:async-http-client." } }, { "id": "CVE-2026-107282", "affects": [ { "ref": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.3" } ], "bom-ref": "urn:uuid:5efd060a-9c8d-56a3-91aa-f066c7fb49c7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-107282 is fixed in version 2.12.3-tuxcare.3 of org.asynchttpclient:async-http-client." } }, { "id": "CVE-2026-107283", "affects": [ { "ref": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.3" } ], "bom-ref": "urn:uuid:d6d24a82-e643-5927-9198-d56a56e8255a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-107283 is fixed in version 2.12.3-tuxcare.3 of org.asynchttpclient:async-http-client." } }, { "id": "CVE-2026-107285", "affects": [ { "ref": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.3" } ], "bom-ref": "urn:uuid:d7894781-f658-59f2-aba6-c5777af73f7c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-107285 is fixed in version 2.12.3-tuxcare.3 of org.asynchttpclient:async-http-client." } }, { "id": "CVE-2026-40490", "affects": [ { "ref": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.3" } ], "bom-ref": "urn:uuid:97fd1062-2d3a-5b4d-bd37-2a2712eea6a6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40490 is fixed in version 2.12.3-tuxcare.3 of org.asynchttpclient:async-http-client." } }, { "id": "CVE-2026-45300", "affects": [ { "ref": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.3" } ], "bom-ref": "urn:uuid:b5a12c50-097d-5483-b6e1-8bcecf6b7411", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-45300 is fixed in version 2.12.3-tuxcare.3 of org.asynchttpclient:async-http-client." } }, { "id": "CVE-2026-55688", "affects": [ { "ref": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.3" } ], "bom-ref": "urn:uuid:43f31369-4616-53de-9195-c165699b90dd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55688 is fixed in version 2.12.3-tuxcare.3 of org.asynchttpclient:async-http-client." } }, { "id": "CVE-2026-85716", "affects": [ { "ref": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.3" } ], "bom-ref": "urn:uuid:097aafb6-e38e-5714-a788-22f84d911338", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-85716 does not affect version 2.12.3-tuxcare.3 of org.asynchttpclient:async-http-client. not_affected \u2014 Target version 2.12.3 is NOT affected by CVE-2026-85716. The CVE explicitly excludes the 2.x line, stating \"The 2.x line is not affected either: it has no SCRAM support, and its interceptor chain does not implement Digest mutual authentication, so there is no verification result to act on.\" Code inspection confirms: (1) No SCRAM support - Realm.AuthScheme enum contains only BASIC, DIGEST, NTLM,...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-85717", "affects": [ { "ref": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.3" } ], "bom-ref": "urn:uuid:5249c72c-c621-5f3e-8a5b-07445dd5456d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-85717 does not affect version 2.12.3-tuxcare.3 of org.asynchttpclient:async-http-client. not_affected \u2014 Version 2.12.3 is NOT affected by CVE-2026-85717. This CVE describes a RESIDUAL vulnerability that bypasses the cross-origin credential strip introduced by GHSA-cmxv-58fp-fm3g. Version 2.12.3 predates that strip mechanism (affected versions: 2.14.5-2.16.0), so the specific bypass chain this CVE addresses cannot occur. The CVE explicitly states: \"Releases below those floors are covered by the ea...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-85720", "affects": [ { "ref": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.3" } ], "bom-ref": "urn:uuid:326e95ad-2908-54e3-8071-e2daaa46d15f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-85720 is fixed in version 2.12.3-tuxcare.3 of org.asynchttpclient:async-http-client." } }, { "id": "CVE-2026-85721", "affects": [ { "ref": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.3" } ], "bom-ref": "urn:uuid:10c55c51-267f-5406-ad60-a686f79345f3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-85721 is fixed in version 2.12.3-tuxcare.3 of org.asynchttpclient:async-http-client." } }, { "id": "GHSA-cmxv-58fp-fm3g", "affects": [ { "ref": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.3" } ], "bom-ref": "urn:uuid:2ed7b7f7-900e-5a73-a3e4-a6fac2ce5871", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cmxv-58fp-fm3g is fixed in version 2.12.3-tuxcare.3 of org.asynchttpclient:async-http-client." } } ], "dependencies": [ { "ref": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.3" } ] }