{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:8a98deb2-ca90-5116-bdd9-b842cb87cadd", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "vertx-core", "purl": "pkg:maven/io.vertx/vertx-core@4.2.4-tuxcare.2", "type": "library", "group": "io.vertx", "bom-ref": "pkg:maven/io.vertx/vertx-core@4.2.4-tuxcare.2", "version": "4.2.4-tuxcare.2", "pedigree": { "ancestors": [ { "name": "vertx-core", "purl": "pkg:maven/io.vertx/vertx-core@4.2.4", "type": "library", "group": "io.vertx", "version": "4.2.4" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2018-12537", "affects": [ { "ref": "pkg:maven/io.vertx/vertx-core@4.2.4-tuxcare.2" } ], "bom-ref": "urn:uuid:0293fa45-c35b-529e-bea7-506ef4fee1de", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-12537 does not affect version 4.2.4-tuxcare.2 of io.vertx:vertx-core. not_affected \u2014 CVE-2018-12537 affects Eclipse Vert.x versions 3.0 to 3.5.1, allowing HTTP header injection via unfiltered CRLF characters. Target version 4.2.4-tuxcare.1 is NOT vulnerable. The fix (CRLF validation in HttpUtils.validateHeaderValue) was added by upstream Vert.x in commit fa03a8e704 (Oct 21, 2018) by Julien Viet, before TuxCare onboarded this version. The validation prevents header injection by ...", "justification": "code_not_present" } }, { "id": "CVE-2018-12541", "affects": [ { "ref": "pkg:maven/io.vertx/vertx-core@4.2.4-tuxcare.2" } ], "bom-ref": "urn:uuid:f7fd2eb8-975d-5355-84df-70293f70f1cf", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-12541 does not affect version 4.2.4-tuxcare.2 of io.vertx:vertx-core. not_affected \u2014 CVE-2018-12541 affects Eclipse Vert.x versions 3.0.0 to 3.5.3, where WebSocket HTTP upgrade requests buffer the full request body without limit. The target version 4.2.4 is not affected because the upstream fix was already present in the 4.2.4 release. The fix (commit eebd62c6391105ddd4c725e21277b69e4363da3d by Julien Viet, 2020-09-08) implements an 8192-byte limit on WebSocket upgrade request ...", "justification": "code_not_present" } }, { "id": "CVE-2018-12544", "affects": [ { "ref": "pkg:maven/io.vertx/vertx-core@4.2.4-tuxcare.2" } ], "bom-ref": "urn:uuid:70e00e41-9eb6-57ff-b20a-994caa3a23a9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-12544 does not affect version 4.2.4-tuxcare.2 of io.vertx:vertx-core. not_affected \u2014 The target repository (vertx-core v4.2.4) does not contain the vulnerable component. CVE-2018-12544 affects the Eclipse Vert.x OpenAPI XML type validator, which is a separate module (typically vertx-web-api-contract) in the Vert.x ecosystem, not part of vertx-core. Exhaustive searches confirmed zero XML parsing APIs, zero OpenAPI-related code, zero schema validation functionality, and no releva...", "justification": "code_not_present" } }, { "id": "CVE-2024-1023", "affects": [ { "ref": "pkg:maven/io.vertx/vertx-core@4.2.4-tuxcare.2" } ], "bom-ref": "urn:uuid:cf4bc03c-03f9-5c2e-948a-988a2d137247", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-1023 does not affect version 4.2.4-tuxcare.2 of io.vertx:vertx-core. not_affected \u2014 Version 4.2.4-tuxcare.1 is NOT AFFECTED by CVE-2024-1023. The vulnerable code pattern (instance FastThreadLocal in CombinerExecutor causing memory leak when HTTP client connects to different hosts) was introduced in version 4.4.5 (commit f15cf1ca8, June 2023) and fixed in version 4.4.7 (commit dd6f64302, January 2024). Version 4.2.4 predates the introduction of this vulnerability and uses a sim...", "justification": "code_not_present" } }, { "id": "CVE-2024-1300", "affects": [ { "ref": "pkg:maven/io.vertx/vertx-core@4.2.4-tuxcare.2" } ], "bom-ref": "urn:uuid:421285ac-21f1-5602-b42a-6ddd3b8118bc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-1300 does not affect version 4.2.4-tuxcare.2 of io.vertx:vertx-core. not_affected \u2014 Version 4.2.4 is not affected by CVE-2024-1300. The vulnerability requires caching SSL contexts using arbitrary SNI server names as map keys, leading to unbounded memory growth. However, version 4.2.4 uses a fundamentally different architecture that caches SSL contexts by Certificate objects (not server names). When an unknown SNI name is received, no cache entry is created (lines 479-480 of SS...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-1002", "affects": [ { "ref": "pkg:maven/io.vertx/vertx-core@4.2.4-tuxcare.2" } ], "bom-ref": "urn:uuid:dc34eabd-cff8-5b64-b17b-23879a00c822", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-1002 affects version 4.2.4-tuxcare.2 of io.vertx:vertx-core." } }, { "id": "CVE-2026-6860", "affects": [ { "ref": "pkg:maven/io.vertx/vertx-core@4.2.4-tuxcare.2" } ], "bom-ref": "urn:uuid:97e5f2f0-e557-599a-aecb-9fb8f4d48fd9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-6860 does not affect version 4.2.4-tuxcare.2 of io.vertx:vertx-core. not_affected \u2014 Vert.x Core 4.2.4 is not affected by CVE-2026-6860. While the target processes SNI values and uses an unbounded ConcurrentHashMap for caching, the cache is keyed by Certificate objects (line 121-122: Map) rather than by SNI name strings. This architectural difference prevents the vulnerability: multiple distinct attacker-controlled SNI names that map to the same wildcar...", "justification": "code_not_reachable" } } ], "dependencies": [ { "ref": "pkg:maven/io.vertx/vertx-core@4.2.4-tuxcare.2" } ] }