{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:cdf9995d-5b1f-5438-a8fe-ee5c381e6056",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "vertx-core",
      "purl": "pkg:maven/io.vertx/vertx-core@4.5.10-tuxcare.2",
      "type": "library",
      "group": "io.vertx",
      "bom-ref": "pkg:maven/io.vertx/vertx-core@4.5.10-tuxcare.2",
      "version": "4.5.10-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "vertx-core",
            "purl": "pkg:maven/io.vertx/vertx-core@4.5.10",
            "type": "library",
            "group": "io.vertx",
            "version": "4.5.10"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-12537",
      "affects": [
        {
          "ref": "pkg:maven/io.vertx/vertx-core@4.5.10-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:afd3b8e9-de5d-5b2c-954d-8c9e78d968ad",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-12537 does not affect version 4.5.10-tuxcare.2 of io.vertx:vertx-core. not_affected \u2014 Vert.x Core version 4.5.10 is not affected by CVE-2018-12537. The vulnerability (HTTP header injection via unfiltered CRLF characters) was fixed in upstream commit fa03a8e70 (October 2018) by adding CRLF validation to HttpUtils.validateHeaderValue(). This fix was already present in the upstream release 4.5.10 before TuxCare onboarded it. The validation is enabled by default and blocks header va...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-12541",
      "affects": [
        {
          "ref": "pkg:maven/io.vertx/vertx-core@4.5.10-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:45b974f0-84fb-5305-abfe-c7ee7cd9e258",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-12541 does not affect version 4.5.10-tuxcare.2 of io.vertx:vertx-core. not_affected \u2014 CVE-2018-12541 describes a vulnerability in Eclipse Vert.x versions 3.0.0 to 3.5.3 where WebSocket HTTP upgrade requests are buffered without limit, potentially exhausting server memory. The target version 4.5.10-tuxcare.1 is not affected because the fix was already present in upstream version 4.5.10 before TuxCare onboarded it. The fix (commit eebd62c63 by Julien Viet) implements the exact def...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-12544",
      "affects": [
        {
          "ref": "pkg:maven/io.vertx/vertx-core@4.5.10-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:35825ef5-01eb-5267-aa79-a8bdc31c9b16",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2018-12544 is a false positive for io.vertx:vertx-core 4.5.10-tuxcare.2. false_positive \u2014 CVE-2018-12544 concerns the Eclipse Vert.x OpenAPI XML type validator component, which is a separate module in the Eclipse Vert.x ecosystem (likely vertx-web-api-contract or vertx-web-openapi). The target repository is vertx-core (io.vertx:vertx-core:4.5.10-tuxcare.1), the low-level core library that does not contain, vendor, or depend on OpenAPI validation functionality. This is a wrong-projec..."
      }
    },
    {
      "id": "CVE-2024-1023",
      "affects": [
        {
          "ref": "pkg:maven/io.vertx/vertx-core@4.5.10-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:ec7b3bec-76ca-56f9-9fb5-13290e0a81f0",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-1023 does not affect version 4.5.10-tuxcare.2 of io.vertx:vertx-core. not_affected \u2014 CVE-2024-1023 describes a memory leak in Eclipse Vert.x caused by creating a new FastThreadLocal instance for each CombinerExecutor. When the HTTP client connects to different hosts, each connection pool creates its own CombinerExecutor, leading to unbounded growth of Netty's InternalThreadLocalMap. The fix (commit 665ceba38) changed the FastThreadLocal from an instance field to a static field,...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-1300",
      "affects": [
        {
          "ref": "pkg:maven/io.vertx/vertx-core@4.5.10-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:d503900e-71f9-54e2-acb6-9235e2f7666b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-1300 does not affect version 4.5.10-tuxcare.2 of io.vertx:vertx-core. not_affected \u2014 Target version 4.5.10-tuxcare.1 is NOT affected by CVE-2024-1300. The vulnerability (memory leak from caching unknown SNI server names) was fixed in the upstream Eclipse Vert.x release 4.5.3 via commit 7ad34ea9d (Feb 5, 2024) by Julien Viet. Version 4.5.10 already contained this fix when TuxCare onboarded it. The fix prevents caching SSL contexts for SNI names without specific certificate mappi...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-1002",
      "affects": [
        {
          "ref": "pkg:maven/io.vertx/vertx-core@4.5.10-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:9e5f0db5-e451-5650-8a63-f97abc5dcf91",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-1002 affects version 4.5.10-tuxcare.2 of io.vertx:vertx-core."
      }
    },
    {
      "id": "CVE-2026-6860",
      "affects": [
        {
          "ref": "pkg:maven/io.vertx/vertx-core@4.5.10-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:c88b2fc0-4c26-5c62-b9ee-deb205b3193b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-6860 affects version 4.5.10-tuxcare.2 of io.vertx:vertx-core."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/io.vertx/vertx-core@4.5.10-tuxcare.2"
    }
  ]
}