{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:967348e7-c803-59ca-8c2d-f112854b49ac",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "vertx-web",
      "purl": "pkg:maven/io.vertx/vertx-web@4.3.8-tuxcare.1",
      "type": "library",
      "group": "io.vertx",
      "bom-ref": "pkg:maven/io.vertx/vertx-web@4.3.8-tuxcare.1",
      "version": "4.3.8-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "vertx-web",
            "purl": "pkg:maven/io.vertx/vertx-web@4.3.8",
            "type": "library",
            "group": "io.vertx",
            "version": "4.3.8"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-12540",
      "affects": [
        {
          "ref": "pkg:maven/io.vertx/vertx-web@4.3.8-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:88970214-6894-5ed9-a8aa-2e33acddd1a9",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-12540 does not affect version 4.3.8-tuxcare.1 of io.vertx:vertx-web. not_affected \u2014 CVE-2018-12540 affects Eclipse Vert.x versions 3.0.0 to 3.5.2 where CSRFHandler did not validate that the XSRF cookie matches the XSRF header/form parameter, allowing replay attacks. The target repository (vertx-web version 4.3.8) is NOT AFFECTED because the upstream fix was already present in version 4.3.8 before TuxCare onboarded it. The fix (commit 98891b1d9) adds validation that both the co...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-12542",
      "affects": [
        {
          "ref": "pkg:maven/io.vertx/vertx-web@4.3.8-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:b0438155-0c12-500f-97a1-d7c7f6c07069",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-12542 does not affect version 4.3.8-tuxcare.1 of io.vertx:vertx-web. not_affected \u2014 CVE-2018-12542 describes a Windows path traversal vulnerability where StaticHandler fails to neutralize backslash sequences in URL paths before directory traversal checks. The target repository (version 4.3.8) is NOT AFFECTED because the vulnerable pattern is not present. An upstream fix (commit d519a0959f by Paulo Lopes, dated 2020-09-28) converted backslashes to forward slashes before calling...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2019-17640",
      "affects": [
        {
          "ref": "pkg:maven/io.vertx/vertx-web@4.3.8-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:83b728bb-c3eb-52a8-beee-671c967a9735",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-17640 does not affect version 4.3.8-tuxcare.1 of io.vertx:vertx-web. not_affected \u2014 CVE-2019-17640 affects StaticHandler in Vert.x versions 3.4.x through 3.9.4 and 4.0.0 milestones/betas, where backslashes in URL paths were not properly normalized on Windows, allowing path traversal outside the webroot. The target repository (vertx-web 4.3.8) is NOT affected because the vulnerability was fixed in the upstream release via commit d519a0959 by Paulo Lopes on Sep 28, 2020. This fi...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-35217",
      "affects": [
        {
          "ref": "pkg:maven/io.vertx/vertx-web@4.3.8-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:b1948ff8-8ed4-51fd-942a-2339c61a97b8",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-35217 does not affect version 4.3.8-tuxcare.1 of io.vertx:vertx-web. not_affected \u2014 The target repository vertx-web version 4.3.8 is not affected by CVE-2020-35217. The vulnerable CSRF verification pattern has been removed by upstream fix commit e889442011127928ec227ea1dfcc5c9587b88585, which was already included in the upstream 4.3.8 release that TuxCare onboarded. The fix changes the validation logic to REQUIRE the CSRF token in the request header/form (not just cookies), im...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-24815",
      "affects": [
        {
          "ref": "pkg:maven/io.vertx/vertx-web@4.3.8-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:a2d8f03f-a991-5188-81ef-4d1e24528faf",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-24815 does not affect version 4.3.8-tuxcare.1 of io.vertx:vertx-web. not_affected \u2014 CVE-2023-24815 is not present in vertx-web 4.3.8. The path traversal vulnerability in StaticHandler's wildcard path handling was fixed upstream by commit 8a6b4ef80 (Paulo Lopes, Feb 2 2023) which shipped in the 4.3.8 release. The fix sanitizes wildcard path parameters by converting Windows backslashes to forward slashes and removing directory traversal dot segments before file lookup, preventin...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-11965",
      "affects": [
        {
          "ref": "pkg:maven/io.vertx/vertx-web@4.3.8-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:c89be3b8-f374-573b-bdf7-5f1edf6916aa",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-11965 affects version 4.3.8-tuxcare.1 of io.vertx:vertx-web."
      }
    },
    {
      "id": "CVE-2025-11966",
      "affects": [
        {
          "ref": "pkg:maven/io.vertx/vertx-web@4.3.8-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:f7e4240b-dd72-55ce-a67f-019ae07d1af1",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-11966 affects version 4.3.8-tuxcare.1 of io.vertx:vertx-web."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/io.vertx/vertx-web@4.3.8-tuxcare.1"
    }
  ]
}