{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:6e895b81-57d3-5772-8ed1-136d5dcb0bc8",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "micronaut-http-server",
      "purl": "pkg:maven/io.micronaut/micronaut-http-server@3.8.4-tuxcare.1",
      "type": "library",
      "group": "io.micronaut",
      "bom-ref": "pkg:maven/io.micronaut/micronaut-http-server@3.8.4-tuxcare.1",
      "version": "3.8.4-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "micronaut-http-server",
            "purl": "pkg:maven/io.micronaut/micronaut-http-server@3.8.4",
            "type": "library",
            "group": "io.micronaut",
            "version": "3.8.4"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2024-23639",
      "affects": [
        {
          "ref": "pkg:maven/io.micronaut/micronaut-http-server@3.8.4-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:13fedc12-ae15-5914-9c88-c675e89f1c47",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-23639 does not affect version 3.8.4-tuxcare.1 of io.micronaut:micronaut-http-server. not_affected \u2014 The target repository (micronaut-core 3.8.4) is NOT AFFECTED by CVE-2024-23639. All three upstream patches that fix the drive-by localhost CORS vulnerability are present in the codebase. The fixes were authored by upstream Micronaut developers (Tim Yates, Sergio del Amo) and were already included in the upstream 3.8.4 release that TuxCare onboarded. The defense logic blocks HTTP requests where ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-33012",
      "affects": [
        {
          "ref": "pkg:maven/io.micronaut/micronaut-http-server@3.8.4-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:5893c34e-9a59-5644-bee4-d451d287d635",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-33012 does not affect version 3.8.4-tuxcare.1 of io.micronaut:micronaut-http-server. not_affected \u2014 CVE-2026-33012 affects micronaut-core versions 4.7.0 through 4.10.6. The target version 3.8.4 is not affected because the vulnerable component `DefaultHtmlErrorResponseBodyProvider` does not exist in this version. This class and its unbounded `ConcurrentHashMap` cache were introduced in version 4.7.0 (commit eccab50ec0 on 2024-10-02). Version 3.8.4 uses a completely different error handling arc...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/io.micronaut/micronaut-http-server@3.8.4-tuxcare.1"
    }
  ]
}