{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:6c895169-5c3b-5b42-b3fc-f5620cc6f2ce", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "vertx-core", "purl": "pkg:maven/io.vertx/vertx-core@4.2.3-tuxcare.1", "type": "library", "group": "io.vertx", "bom-ref": "pkg:maven/io.vertx/vertx-core@4.2.3-tuxcare.1", "version": "4.2.3-tuxcare.1", "pedigree": { "ancestors": [ { "name": "vertx-core", "purl": "pkg:maven/io.vertx/vertx-core@4.2.3", "type": "library", "group": "io.vertx", "version": "4.2.3" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2018-12537", "affects": [ { "ref": "pkg:maven/io.vertx/vertx-core@4.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:068f6ff3-6dda-5421-8233-ec65a73264b5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-12537 does not affect version 4.2.3-tuxcare.1 of io.vertx:vertx-core. not_affected \u2014 The target Vert.x 4.2.3 is NOT AFFECTED by CVE-2018-12537 (HTTP header CR/LF injection). The vulnerability fix was already present in the upstream release 4.2.3 when TuxCare onboarded it. The fix commit 1bb6445226c39a95e7d07ce3caaf56828e8aab72 (authored by upstream developer julien@julienviet.com) is an ancestor of HEAD and predates the first TuxCare commit 3d9aef72c. The code contains robust v...", "justification": "code_not_present" } }, { "id": "CVE-2018-12541", "affects": [ { "ref": "pkg:maven/io.vertx/vertx-core@4.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:db3d781f-6040-5580-bc89-c84c03f23bcc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-12541 does not affect version 4.2.3-tuxcare.1 of io.vertx:vertx-core. not_affected \u2014 Target repository Eclipse Vert.x Core version 4.2.3 is not affected by CVE-2018-12541. The vulnerability (unbounded memory consumption during WebSocket upgrade) was fixed in the upstream codebase before this version was released. The fix, which limits WebSocket upgrade request body size to 8192 bytes and returns HTTP 413 status code if exceeded, is present in Http1xServerRequest.java lines 427-...", "justification": "code_not_present" } }, { "id": "CVE-2018-12544", "affects": [ { "ref": "pkg:maven/io.vertx/vertx-core@4.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:3724ad76-d4ce-5853-b51a-50df3c670d20", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-12544 does not affect version 4.2.3-tuxcare.1 of io.vertx:vertx-core. not_affected \u2014 CVE-2018-12544 affects the Eclipse Vert.x OpenAPI XML type validator component in versions 3.5.Beta1 to 3.5.3. The target repository is vertx-core version 4.2.3, which is the core library providing low-level functionality. The OpenAPI XML type validator component does not exist in vertx-core\u2014it resides in a separate Vert.x module (likely vertx-web-api-contract). Exhaustive searches confirmed no...", "justification": "code_not_present" } }, { "id": "CVE-2024-1023", "affects": [ { "ref": "pkg:maven/io.vertx/vertx-core@4.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:4a93d443-e3c2-5048-b9b1-17c46d619897", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-1023 does not affect version 4.2.3-tuxcare.1 of io.vertx:vertx-core. not_affected \u2014 CVE-2024-1023 describes a memory leak in Eclipse Vert.x caused by instance-level FastThreadLocal fields in the CombinerExecutor class. Each new CombinerExecutor instance (created when HTTP client connects to different hosts) created a new FastThreadLocal, causing unbounded growth of Netty's InternalThreadLocalMap index and corresponding memory consumption. The target version 4.2.3 uses a comple...", "justification": "code_not_present" } }, { "id": "CVE-2024-1300", "affects": [ { "ref": "pkg:maven/io.vertx/vertx-core@4.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:f664ed81-bfb5-5e75-a56a-f991b93f1e38", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-1300 does not affect version 4.2.3-tuxcare.1 of io.vertx:vertx-core. not_affected \u2014 CVE-2024-1300 affects Eclipse Vert.x 4.5+/5.x due to unbounded Map caching that grows with arbitrary SNI server names. Version 4.2.3 uses a fundamentally different architecture: Map with a null-guard that prevents caching unknown SNI names. The vulnerable code pattern (caching by server name string) does not exist in 4.2.3, making it structurally imm...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-1002", "affects": [ { "ref": "pkg:maven/io.vertx/vertx-core@4.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:0c90f516-fbf4-5a26-956f-80c9b6d3a86b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-1002 does not affect version 4.2.3-tuxcare.1 of io.vertx:vertx-core. not_affected \u2014 vertx-core 4.2.3 contains the buggy RFC3986 path normalization implementation (HttpUtils.removeDots lines 333-346) that fails to clear the output buffer when processing `/../` patterns with no forward slash present. However, vertx-core is a library that exports this utility function but does not itself implement static file serving. The complete attack chain from malicious HTTP request to denia...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-6860", "affects": [ { "ref": "pkg:maven/io.vertx/vertx-core@4.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:8ba4ded0-3f82-5fa9-985a-c73d7bf80336", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-6860 does not affect version 4.2.3-tuxcare.1 of io.vertx:vertx-core. not_affected \u2014 Version 4.2.3 is not affected by CVE-2026-6860. The vulnerable code pattern (unbounded serverName-keyed SNI cache) is not present in this version. Target uses Certificate-keyed caching in SSLHelper (line 121: Map), where multiple SNI values matching the same wildcard certificate map to the same cache entry. The vulnerability was introduced in later versions (4.3.4+) whe...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/io.vertx/vertx-core@4.2.3-tuxcare.1" } ] }