{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:e54b22e8-4ccb-53d9-899d-de21061ee980",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "vertx-core",
      "purl": "pkg:maven/io.vertx/vertx-core@3.9.6-tuxcare.1",
      "type": "library",
      "group": "io.vertx",
      "bom-ref": "pkg:maven/io.vertx/vertx-core@3.9.6-tuxcare.1",
      "version": "3.9.6-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "vertx-core",
            "purl": "pkg:maven/io.vertx/vertx-core@3.9.6",
            "type": "library",
            "group": "io.vertx",
            "version": "3.9.6"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-12537",
      "affects": [
        {
          "ref": "pkg:maven/io.vertx/vertx-core@3.9.6-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:660f054d-c42c-5ff0-9c63-ec6c7ec683e0",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-12537 affects version 3.9.6-tuxcare.1 of io.vertx:vertx-core."
      }
    },
    {
      "id": "CVE-2018-12541",
      "affects": [
        {
          "ref": "pkg:maven/io.vertx/vertx-core@3.9.6-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:dac8303f-41a0-5ccf-8b05-8a501c05b5a5",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-12541 does not affect version 3.9.6-tuxcare.1 of io.vertx:vertx-core. Prechecker: The method the fix changes and the vulnerable lines are absent from this version. Version 3.9.6 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-45xm-v8gq-7jqx (affected up to 3.5.4), NVD (affected up to 3.5.4), Snyk (affected up to 3.5.4).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-12544",
      "affects": [
        {
          "ref": "pkg:maven/io.vertx/vertx-core@3.9.6-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:390c3f52-2d20-5136-a355-b6a1c63dfc4c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-12544 affects version 3.9.6-tuxcare.1 of io.vertx:vertx-core."
      }
    },
    {
      "id": "CVE-2024-1023",
      "affects": [
        {
          "ref": "pkg:maven/io.vertx/vertx-core@3.9.6-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:aee8057d-e585-567d-8dd4-2e9df4020859",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-1023 does not affect version 3.9.6-tuxcare.1 of io.vertx:vertx-core. Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 3.9.6 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-5667-3wch-7q7w (newer lines only), CVE record (newer lines only), Snyk (newer lines only).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-1300",
      "affects": [
        {
          "ref": "pkg:maven/io.vertx/vertx-core@3.9.6-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:5c75fea3-2ba0-5b75-8773-da0b2c270dbc",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-1300 does not affect version 3.9.6-tuxcare.1 of io.vertx:vertx-core. not_affected \u2014 Vert.x 3.9.6 is not affected. SSLHelper.getContext() caches SSL contexts keyed by the server's Certificate, not by the client-supplied SNI name. Unknown SNI names return the already-built default context without any cache insertion. The map is therefore bounded by the number of configured certificates, and fake server names cannot grow it.",
        "justification": "code_not_reachable"
      }
    },
    {
      "id": "CVE-2026-1002",
      "affects": [
        {
          "ref": "pkg:maven/io.vertx/vertx-core@3.9.6-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:85a78aaa-bfd1-5794-af48-b6821984ddee",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-1002 does not affect version 3.9.6-tuxcare.1 of io.vertx:vertx-core. not_affected \u2014 Not affected, with moderate confidence. The patch diff was not supplied (only commit URLs), so I could not compare against the real fix hunks. In vert.x 3.9.6, HttpUtils.removeDots/normalizePath handle the CVE's trigger shape (dot segments after the last slash, e.g. /foo/bar/../index.html) correctly. They return /foo/index.html, matching an RFC 3986 reference. I found no input that reaches the ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-6860",
      "affects": [
        {
          "ref": "pkg:maven/io.vertx/vertx-core@3.9.6-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:0d5fe44a-c371-5f8d-a550-3fde82532007",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-6860 does not affect version 3.9.6-tuxcare.1 of io.vertx:vertx-core. not_affected \u2014 Vert.x 3.9.6 does not have the serverName-keyed SslContext cache. SSLHelper caches SslContext by the selected certificate (first cert of the chain), and the candidate certificates come from a fixed, keystore-derived map. Distinct attacker-chosen SNI names that match a wildcard resolve to the same certificate and the same cache entry, so cache growth is bounded by the number of keystore certific...",
        "justification": "code_not_reachable"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/io.vertx/vertx-core@3.9.6-tuxcare.1"
    }
  ]
}