{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:776757a4-e152-5a42-b1de-cb29b83d78ad",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "x-pack-security",
      "purl": "pkg:maven/org.elasticsearch.plugin/x-pack-security@7.16.3-tuxcare.2",
      "type": "library",
      "group": "org.elasticsearch.plugin",
      "bom-ref": "pkg:maven/org.elasticsearch.plugin/x-pack-security@7.16.3-tuxcare.2",
      "version": "7.16.3-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "x-pack-security",
            "purl": "pkg:maven/org.elasticsearch.plugin/x-pack-security@7.16.3",
            "type": "library",
            "group": "org.elasticsearch.plugin",
            "version": "7.16.3"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2025-37731",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch.plugin/x-pack-security@7.16.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:2f4ee5ab-c434-564d-bbaf-6d6cd7b7c341",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-37731 affects version 7.16.3-tuxcare.2 of org.elasticsearch.plugin:x-pack-security."
      }
    },
    {
      "id": "CVE-2025-68384",
      "affects": [
        {
          "ref": "pkg:maven/org.elasticsearch.plugin/x-pack-security@7.16.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:e208ef17-4e0b-5ec6-b636-f83477defa54",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-68384 does not affect version 7.16.3-tuxcare.2 of org.elasticsearch.plugin:x-pack-security. not_affected \u2014 Elasticsearch 7.16.3 does not contain the user profile feature that is vulnerable in CVE-2025-68384. The entire user profile functionality (ProfileService, UpdateProfileDataRequest, profile REST endpoints) was introduced in Elasticsearch 8.x and does not exist in this version. The vulnerability affects code that validates profile data size during updates, but since the profile update mechanism ...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.elasticsearch.plugin/x-pack-security@7.16.3-tuxcare.2"
    }
  ]
}