{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:ee75e437-faa2-5697-a3a0-409078bc727d",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "protobuf-kotlin",
      "purl": "pkg:maven/com.google.protobuf/protobuf-kotlin@3.21.9-tuxcare.3",
      "type": "library",
      "group": "com.google.protobuf",
      "bom-ref": "pkg:maven/com.google.protobuf/protobuf-kotlin@3.21.9-tuxcare.3",
      "version": "3.21.9-tuxcare.3",
      "pedigree": {
        "ancestors": [
          {
            "name": "protobuf-kotlin",
            "purl": "pkg:maven/com.google.protobuf/protobuf-kotlin@3.21.9",
            "type": "library",
            "group": "com.google.protobuf",
            "version": "3.21.9"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2021-22569",
      "affects": [
        {
          "ref": "pkg:maven/com.google.protobuf/protobuf-kotlin@3.21.9-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:840cf9a7-af4d-5760-8475-ef90b475be68",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-22569 does not affect version 3.21.9-tuxcare.3 of com.google.protobuf:protobuf-kotlin. The target protobuf version 3.21.9 is NOT affected by CVE-2021-22569. The vulnerability (DoS via excessive GC pauses when parsing alternating unknown field numbers) was fixed in the upstream release before TuxCare onboarded it. The target contains the fixed implementation using TreeMap-based field builder storage, eliminating the object allocation thrashing that caused the vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.16.1; >= 3.18.0, < 3.18.2; >= 3.19.0, < 3.19.2; >= 3.18.0, < 3.18.2; >= 3.19.0, < 3.19.2), NVD (< 3.19.2; < 3.16.1; >= 3.18.0, < 3.18.2; >= 3.19.0, < 3.19.2; < 3.18.2; >= 3.19.0, < 3.19.2), cve.org (< 3.16.1; < 3.18.2; < 3.19.2; < 3.18.2; < 3.19.2; < 3.19.2), Snyk (< 3.16.1; >= 3.17.0, < 3.18.2; >= 3.19.0, < 3.19.2; < 3.18.2; >= 3.19.0, < 3.19.2).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-3171",
      "affects": [
        {
          "ref": "pkg:maven/com.google.protobuf/protobuf-kotlin@3.21.9-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:b9fb41db-7827-5e1f-9be5-481d47ece64b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-3171 does not affect version 3.21.9-tuxcare.3 of com.google.protobuf:protobuf-kotlin. not_affected \u2014 The target repository (protobuf version 3.21.9) is NOT affected by CVE-2022-3171. The vulnerability was fixed in upstream protobuf 3.21.7 (released 2022-09-27) and the fix was already present in the 3.21.9 release that TuxCare onboarded on 2026-05-06. The fix commit (3b5301c11) is authored by upstream developer Mike Kruskal, not TuxCare. The vulnerable parsing pattern (creating new message inst...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-7254",
      "affects": [
        {
          "ref": "pkg:maven/com.google.protobuf/protobuf-kotlin@3.21.9-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:904ab486-7016-539a-be4f-4a31ae8026dc",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-7254 is fixed in version 3.21.9-tuxcare.3 of com.google.protobuf:protobuf-kotlin."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/com.google.protobuf/protobuf-kotlin@3.21.9-tuxcare.3"
    }
  ]
}