{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:1422943c-4049-58f5-83ec-06d84634d761",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "jackson-dataformat-cbor",
      "purl": "pkg:maven/com.fasterxml.jackson.dataformat/jackson-dataformat-cbor@2.15.4-tuxcare.1",
      "type": "library",
      "group": "com.fasterxml.jackson.dataformat",
      "bom-ref": "pkg:maven/com.fasterxml.jackson.dataformat/jackson-dataformat-cbor@2.15.4-tuxcare.1",
      "version": "2.15.4-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "jackson-dataformat-cbor",
            "purl": "pkg:maven/com.fasterxml.jackson.dataformat/jackson-dataformat-cbor@2.15.4",
            "type": "library",
            "group": "com.fasterxml.jackson.dataformat",
            "version": "2.15.4"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2020-28491",
      "affects": [
        {
          "ref": "pkg:maven/com.fasterxml.jackson.dataformat/jackson-dataformat-cbor@2.15.4-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:7f4af875-cc15-5aed-a1c6-2b3fe631e695",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-28491 does not affect version 2.15.4-tuxcare.1 of com.fasterxml.jackson.dataformat:jackson-dataformat-cbor. The target version 2.15.4-tuxcare.3 is not affected by CVE-2020-28491. The vulnerability (unchecked allocation of byte buffers causing OutOfMemoryError) was fixed in upstream version 2.11.4 (December 2020) by commit de072d314af8f5f269c8abec6930652af67bc8e6. The fix introduces a 250KB threshold for binary data: lengths exceeding this limit are read incrementally rather than allocated upfront, preventing memory exhaustion attacks. This fix was already present in the upstream 2.15.4 release that TuxCare onboarded, making this an upstream fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0rc1, < 2.11.4; >= 2.12.0rc1, < 2.12.1), NVD (< 2.11.4; > 2.12.0, < 2.12.1; = 2.12.0; = 2.12.0-rc1; = 2.12.0-rc2), cve.org (< 2.11.4; >= 2.12.0-rc1, < 2.12.1), Snyk (>= 0, < 2.11.4; >= 2.12.0-rc1, < 2.12.1).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-106554",
      "affects": [
        {
          "ref": "pkg:maven/com.fasterxml.jackson.dataformat/jackson-dataformat-cbor@2.15.4-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:7b2863fd-2e81-5766-a632-d95d12145c25",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-106554 affects version 2.15.4-tuxcare.1 of com.fasterxml.jackson.dataformat:jackson-dataformat-cbor."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/com.fasterxml.jackson.dataformat/jackson-dataformat-cbor@2.15.4-tuxcare.1"
    }
  ]
}