{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:086dab43-b627-5175-9373-6813d72a1449",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "micronaut-http-client",
      "purl": "pkg:maven/io.micronaut/micronaut-http-client@3.8.4-tuxcare.1",
      "type": "library",
      "group": "io.micronaut",
      "bom-ref": "pkg:maven/io.micronaut/micronaut-http-client@3.8.4-tuxcare.1",
      "version": "3.8.4-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "micronaut-http-client",
            "purl": "pkg:maven/io.micronaut/micronaut-http-client@3.8.4",
            "type": "library",
            "group": "io.micronaut",
            "version": "3.8.4"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2020-7611",
      "affects": [
        {
          "ref": "pkg:maven/io.micronaut/micronaut-http-client@3.8.4-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:b7dcb605-086d-5fc8-b7b7-57f3a5afce19",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-7611 does not affect version 3.8.4-tuxcare.1 of io.micronaut:micronaut-http-client. not_affected \u2014 CVE-2020-7611 (HTTP Request Header Injection) is NOT present in Micronaut 3.8.4. The vulnerability allowed attackers to inject CRLF sequences into HTTP headers, enabling HTTP request smuggling. The fix (enabling Netty's header validation) was committed in Feb-March 2020 (commits 6deb60b755, 9d1eff5c8d, bc855e439c) and shipped in the upstream v3.8.4 release (Feb 2023). Current code at NettyHttpH...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "GHSA-387m-935m-c4vw",
      "affects": [
        {
          "ref": "pkg:maven/io.micronaut/micronaut-http-client@3.8.4-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:1f5aa430-2e64-5c79-88fd-a8af330e00c2",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-387m-935m-c4vw is fixed in version 3.8.4-tuxcare.1 of io.micronaut:micronaut-http-client."
      }
    },
    {
      "id": "GHSA-q6gh-6v2r-hjv3",
      "affects": [
        {
          "ref": "pkg:maven/io.micronaut/micronaut-http-client@3.8.4-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:3a2d05a3-f4f9-5f7a-8d99-77ffcb8ee275",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-q6gh-6v2r-hjv3 is fixed in version 3.8.4-tuxcare.1 of io.micronaut:micronaut-http-client."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/io.micronaut/micronaut-http-client@3.8.4-tuxcare.1"
    }
  ]
}