{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:f3242a78-207a-5c81-861b-783f059178f8",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "vertx-core",
      "purl": "pkg:maven/io.vertx/vertx-core@4.5.8-tuxcare.1",
      "type": "library",
      "group": "io.vertx",
      "bom-ref": "pkg:maven/io.vertx/vertx-core@4.5.8-tuxcare.1",
      "version": "4.5.8-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "vertx-core",
            "purl": "pkg:maven/io.vertx/vertx-core@4.5.8",
            "type": "library",
            "group": "io.vertx",
            "version": "4.5.8"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-12537",
      "affects": [
        {
          "ref": "pkg:maven/io.vertx/vertx-core@4.5.8-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:1501bb9b-0b06-5d19-bb40-601bdd56f6e5",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-12537 does not affect version 4.5.8-tuxcare.1 of io.vertx:vertx-core. not_affected \u2014 CVE-2018-12537 affects Eclipse Vert.x versions 3.0-3.5.1, where HTTP headers did not filter CR/LF characters, enabling header injection attacks. The target version 4.5.8 is not affected because the fix was introduced in upstream version 3.6.0 (commit fa03a8e70 by Julien Viet on 2018-10-21). The target implements comprehensive header validation via HttpUtils.validateHeaderValue() that enforces p...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-12541",
      "affects": [
        {
          "ref": "pkg:maven/io.vertx/vertx-core@4.5.8-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:d708a4f3-ff81-5a7e-9a0f-acc8890a6b2e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-12541 does not affect version 4.5.8-tuxcare.1 of io.vertx:vertx-core. not_affected \u2014 CVE-2018-12541 affects Eclipse Vert.x versions 3.0.0 to 3.5.3, where WebSocket HTTP upgrade implementation buffers the full request body without limit. Target version 4.5.8 contains the upstream fix (commit eebd62c6) introduced in Vert.x 4.0.0, which limits WebSocket upgrade request body buffering to 8192 bytes and returns HTTP 413 status when exceeded. The vulnerable unbounded buffering patter...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-12544",
      "affects": [
        {
          "ref": "pkg:maven/io.vertx/vertx-core@4.5.8-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:b177093d-9b2e-5d2b-b26e-aaae202467f6",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2018-12544 is a false positive for io.vertx:vertx-core 4.5.8-tuxcare.1. false_positive \u2014 CVE-2018-12544 concerns the Eclipse Vert.x OpenAPI XML type validator component, which exists in separate modules (io.vertx:vertx-web-api-contract or io.vertx:vertx-openapi). The target repository is io.vertx:vertx-core version 4.5.8, which is the foundational networking/event loop library. This core module does not contain, vendor, bundle, or depend on any OpenAPI functionality. The vulnerable..."
      }
    },
    {
      "id": "CVE-2024-1023",
      "affects": [
        {
          "ref": "pkg:maven/io.vertx/vertx-core@4.5.8-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:ed9efd82-b0ec-571f-bcd4-61109db339c4",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-1023 does not affect version 4.5.8-tuxcare.1 of io.vertx:vertx-core. not_affected \u2014 CVE-2024-1023 describes a memory leak in Eclipse Vert.x caused by improper use of Netty FastThreadLocal in the CombinerExecutor class. The vulnerability occurred when creating FastThreadLocal instances per CombinerExecutor (each HTTP endpoint to different hosts creates a new instance), causing unbounded growth of InternalThreadLocalMap in pooled threads. The target version 4.5.8 is NOT AFFECTED...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-1300",
      "affects": [
        {
          "ref": "pkg:maven/io.vertx/vertx-core@4.5.8-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:26da0048-ec9a-5220-8b1f-41d9fb091fea",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-1300 does not affect version 4.5.8-tuxcare.1 of io.vertx:vertx-core. not_affected \u2014 CVE-2024-1300 affects Eclipse Vert.x TCP servers with SNI enabled, causing memory exhaustion when attackers send TLS client hello messages with spurious SNI server names. The vulnerability was fixed in upstream commit 7ad34ea9d by Julien Viet on Feb 5, 2024. The target repository (vertx-core 4.5.8) contains this upstream fix, which was already present in the upstream 4.5.8 release (May 24, 2024...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-1002",
      "affects": [
        {
          "ref": "pkg:maven/io.vertx/vertx-core@4.5.8-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:5b528823-e03b-59a6-b42b-855988e059d5",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-1002 affects version 4.5.8-tuxcare.1 of io.vertx:vertx-core."
      }
    },
    {
      "id": "CVE-2026-6860",
      "affects": [
        {
          "ref": "pkg:maven/io.vertx/vertx-core@4.5.8-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:07fc8cbd-3842-5b69-a883-30a450952a14",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-6860 affects version 4.5.8-tuxcare.1 of io.vertx:vertx-core."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/io.vertx/vertx-core@4.5.8-tuxcare.1"
    }
  ]
}