{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:1b910b5c-780a-50c9-b261-397e0cd5eb82",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "vertx-core",
      "purl": "pkg:maven/io.vertx/vertx-core@4.5.11-tuxcare.2",
      "type": "library",
      "group": "io.vertx",
      "bom-ref": "pkg:maven/io.vertx/vertx-core@4.5.11-tuxcare.2",
      "version": "4.5.11-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "vertx-core",
            "purl": "pkg:maven/io.vertx/vertx-core@4.5.11",
            "type": "library",
            "group": "io.vertx",
            "version": "4.5.11"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-12537",
      "affects": [
        {
          "ref": "pkg:maven/io.vertx/vertx-core@4.5.11-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:457fbc6d-12ff-5464-b878-aff57e04175a",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-12537 does not affect version 4.5.11-tuxcare.2 of io.vertx:vertx-core. not_affected \u2014 CVE-2018-12537 affects Eclipse Vert.x 3.0-3.5.1 where HTTP header values are not validated for CRLF characters, allowing header injection. Target version 4.5.11-tuxcare.1 is NOT affected: the vulnerable pattern is not present because upstream Vert.x added comprehensive CRLF validation in May 2018 (commit 1bb64452 by julien@julienviet.com). The validation is active by default in both HttpServerR...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-12541",
      "affects": [
        {
          "ref": "pkg:maven/io.vertx/vertx-core@4.5.11-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:77b281e4-6af0-51bd-9f80-04565753acc9",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-12541 does not affect version 4.5.11-tuxcare.2 of io.vertx:vertx-core. not_affected \u2014 CVE-2018-12541 is not present in target version 4.5.11-tuxcare.1. The vulnerability affected Vert.x 3.0.0-3.5.3 where WebSocket HTTP upgrade buffered unlimited request bodies causing memory exhaustion. The fix (8192-byte limit with HTTP 413 response) was introduced by upstream developer Julien Viet in September 2020 and shipped in upstream release 4.5.11 before TuxCare onboarding. The defense c...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-12544",
      "affects": [
        {
          "ref": "pkg:maven/io.vertx/vertx-core@4.5.11-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:a3c6036d-02d6-59eb-b98e-7bd6a971c77e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-12544 does not affect version 4.5.11-tuxcare.2 of io.vertx:vertx-core. not_affected \u2014 CVE-2018-12544 affects the Eclipse Vert.x OpenAPI XML type validator component, which is not present in vertx-core. The target repository is vertx-core version 4.5.11-tuxcare.1, the core library module of Eclipse Vert.x. OpenAPI functionality, including the vulnerable XML type validator, resides in separate Vert.x modules (vertx-web-openapi or vertx-web-api-contract), not in the core library. E...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-1023",
      "affects": [
        {
          "ref": "pkg:maven/io.vertx/vertx-core@4.5.11-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:7d38f5d4-23b2-519d-ada5-3a9422b0aac9",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-1023 does not affect version 4.5.11-tuxcare.2 of io.vertx:vertx-core. not_affected \u2014 CVE-2024-1023 describes a memory leak in Eclipse Vert.x due to instance-level FastThreadLocal usage in CombinerExecutor. When the HTTP client connects to different hosts, each host gets a separate endpoint with its own CombinerExecutor instance, and each CombinerExecutor created its own FastThreadLocal, causing unbounded growth of InternalThreadLocalMap. The target version 4.5.11-tuxcare.1 is N...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-1300",
      "affects": [
        {
          "ref": "pkg:maven/io.vertx/vertx-core@4.5.11-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:956aac38-3f13-592e-ad26-9c777912c476",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-1300 does not affect version 4.5.11-tuxcare.2 of io.vertx:vertx-core. not_affected \u2014 CVE-2024-1300 does not affect this version. The vulnerability (unbounded memory allocation from caching SSL contexts for unknown SNI server names) was fixed in upstream Vert.x release 4.5.11 via commit 7ad34ea9d. TuxCare onboarded this already-fixed version. The fix is present in SslChannelProvider.sslContext() at lines 89-103, which prevents caching when no specific certificate mapping exists ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-1002",
      "affects": [
        {
          "ref": "pkg:maven/io.vertx/vertx-core@4.5.11-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:2f111fd0-2795-5879-8ef7-116585c55f41",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-1002 affects version 4.5.11-tuxcare.2 of io.vertx:vertx-core."
      }
    },
    {
      "id": "CVE-2026-6860",
      "affects": [
        {
          "ref": "pkg:maven/io.vertx/vertx-core@4.5.11-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:7e68df39-1caf-5948-9e6d-f62c87c4c831",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-6860 affects version 4.5.11-tuxcare.2 of io.vertx:vertx-core."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/io.vertx/vertx-core@4.5.11-tuxcare.2"
    }
  ]
}