{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:2a15a9de-907b-5f3d-95a3-e279a0787c1e",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "c3p0",
      "purl": "pkg:maven/com.mchange/c3p0@0.9.5.4-tuxcare.5",
      "type": "library",
      "group": "com.mchange",
      "bom-ref": "pkg:maven/com.mchange/c3p0@0.9.5.4-tuxcare.5",
      "version": "0.9.5.4-tuxcare.5",
      "pedigree": {
        "ancestors": [
          {
            "name": "c3p0",
            "purl": "pkg:maven/com.mchange/c3p0@0.9.5.4",
            "type": "library",
            "group": "com.mchange",
            "version": "0.9.5.4"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-20433",
      "affects": [
        {
          "ref": "pkg:maven/com.mchange/c3p0@0.9.5.4-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:46e9f88d-f464-58b6-b711-dfc5481ff1b1",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-20433 does not affect version 0.9.5.4-tuxcare.5 of com.mchange:c3p0. CVE-2018-20433 (XXE vulnerability in c3p0 XML configuration parsing) is NOT present in target version 0.9.5.4-tuxcare.5. The vulnerability was fixed by upstream maintainer Steve Waldman in commits 7dfdda63 (Jan 26, 2019) and f38f2763, both of which were already included in upstream release 0.9.5.4 before TuxCare onboarded it. The target implements comprehensive XXE defenses including disabling entity expansion, DOCTYPE declarations, external entities, and XInclude by default. The vulnerable pattern (unrestricted XML entity expansion during initialization) is not present in the default configuration.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 0.9.5.3), NVD (= 0.9.5.2), Snyk (< 0.9.5.3).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2019-5427",
      "affects": [
        {
          "ref": "pkg:maven/com.mchange/c3p0@0.9.5.4-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:9c982b2e-0152-5998-b741-c699583bc918",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-5427 does not affect version 0.9.5.4-tuxcare.5 of com.mchange:c3p0. The target c3p0 version 0.9.5.4-tuxcare.5 is NOT AFFECTED by CVE-2019-5427 (billion laughs attack via recursive entity expansion). The fix was already included in the upstream 0.9.5.4 release (commit f38f27635c384806c2a9d6500d80183d9f09d78b by Steve Waldman) before TuxCare onboarded the version. The fix adds comprehensive XML parsing restrictions in C3P0ConfigXmlUtils.java via the cautionDocumentBuilderFactory() method, which disables DOCTYPE declarations, entity expansion, XML includes, and external DTDs by default. The vulnerable pattern (unrestricted XML parsing allowing entity expansion) is not present in the default code path.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 0.9.5.4), NVD (< 0.9.5.4), cve.org (< 0.9.5.4), Snyk (< 0.9.5.4).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-27830",
      "affects": [
        {
          "ref": "pkg:maven/com.mchange/c3p0@0.9.5.4-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:c8b11cc6-aba7-540b-a288-2ef661433c71",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-27830 is fixed in version 0.9.5.4-tuxcare.5 of com.mchange:c3p0."
      }
    },
    {
      "id": "CVE-2026-55223",
      "affects": [
        {
          "ref": "pkg:maven/com.mchange/c3p0@0.9.5.4-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:b8236482-b6d4-5984-8653-cedb1f4b5551",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-55223 is fixed in version 0.9.5.4-tuxcare.5 of com.mchange:c3p0."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/com.mchange/c3p0@0.9.5.4-tuxcare.5"
    }
  ]
}