{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:1369277f-782d-5ba7-8d29-a1949acf90d1",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "vertx-web",
      "purl": "pkg:maven/io.vertx/vertx-web@4.5.10-tuxcare.3",
      "type": "library",
      "group": "io.vertx",
      "bom-ref": "pkg:maven/io.vertx/vertx-web@4.5.10-tuxcare.3",
      "version": "4.5.10-tuxcare.3",
      "pedigree": {
        "ancestors": [
          {
            "name": "vertx-web",
            "purl": "pkg:maven/io.vertx/vertx-web@4.5.10",
            "type": "library",
            "group": "io.vertx",
            "version": "4.5.10"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-12540",
      "affects": [
        {
          "ref": "pkg:maven/io.vertx/vertx-web@4.5.10-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:f35e8de3-74dc-5bfe-b4d3-0ca65136f4b0",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-12540 does not affect version 4.5.10-tuxcare.3 of io.vertx:vertx-web. not_affected \u2014 CVE-2018-12540 affects Vert.x versions 3.0.0 to 3.5.2 where CSRFHandler failed to validate that the CSRF token in the request header/form matches the token in the cookie, allowing replay attacks. The target repository at version 4.5.10 contains the upstream vendor fix (commit 98891b1d9, June 2018) that validates cookie-to-header equality using MessageDigest.isEqual() at CSRFHandlerImpl.java:234...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-12542",
      "affects": [
        {
          "ref": "pkg:maven/io.vertx/vertx-web@4.5.10-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:2a835962-36b9-551d-b458-bdd45b500d52",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-12542 does not affect version 4.5.10-tuxcare.3 of io.vertx:vertx-web. not_affected \u2014 The target (vertx-web 4.5.10) is not affected by CVE-2018-12542. The vulnerability involved path traversal on Windows via backslash characters that bypassed dot-removal logic in StaticHandler. The fix normalizes backslash characters to forward slashes before applying dot-removal at StaticHandlerImpl.java:187 (`uriDecodedPath.replace('\\\\', '/')`). This fix was authored by Paulo Lopes (upstream d...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2019-17640",
      "affects": [
        {
          "ref": "pkg:maven/io.vertx/vertx-web@4.5.10-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:a01db968-8b1a-572d-a9e7-178307606e91",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-17640 does not affect version 4.5.10-tuxcare.3 of io.vertx:vertx-web. not_affected \u2014 CVE-2019-17640 describes a path traversal vulnerability in Vert.x StaticHandler where backslashes in URL paths on Windows could bypass dot-removal traversal checks. The target repository at version 4.5.10 is NOT AFFECTED because the upstream vendor's fix (commit d519a0959) was already present in the version TuxCare onboarded. The fix at line 187 of StaticHandlerImpl.java explicitly converts bac...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-35217",
      "affects": [
        {
          "ref": "pkg:maven/io.vertx/vertx-web@4.5.10-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:de7b7b33-2cce-5869-a2ed-174fc4d51b78",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-35217 does not affect version 4.5.10-tuxcare.3 of io.vertx:vertx-web. not_affected \u2014 CVE-2020-35217 (CSRF verification bypass) is NOT present in vertx-web 4.5.10. The vulnerability was fixed in upstream commits e889442011127928ec227ea1dfcc5c9587b88585 (May 19, 2020) and 41a5534ff95c8bac1c6a0e715d7f0d1ad3c10bc4 (May 20, 2020) by Paulo Lopes. These fixes were included in the upstream 4.5.10 release (September 2024) that TuxCare subsequently onboarded (November 2026). The target c...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-24815",
      "affects": [
        {
          "ref": "pkg:maven/io.vertx/vertx-web@4.5.10-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:4c1a1e44-a269-5bc6-909f-31b6d5838872",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-24815 does not affect version 4.5.10-tuxcare.3 of io.vertx:vertx-web. not_affected \u2014 Target version 4.5.10 is not affected by CVE-2023-24815. The vulnerability (Windows path traversal via backslash in StaticHandler wildcard routes allowing classpath exfiltration) was fixed upstream by Paulo Lopes in commit 9e3a783b1 (Feb 2, 2023) and shipped in version 4.4.0. The fix was already present in version 4.5.10 when TuxCare onboarded it. The defense at Utils.java lines 84-85 converts ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-11965",
      "affects": [
        {
          "ref": "pkg:maven/io.vertx/vertx-web@4.5.10-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:2954578a-968a-53eb-b156-75db4fdfbdb5",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-11965 affects version 4.5.10-tuxcare.3 of io.vertx:vertx-web."
      }
    },
    {
      "id": "CVE-2025-11966",
      "affects": [
        {
          "ref": "pkg:maven/io.vertx/vertx-web@4.5.10-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:94b7dd79-965b-5136-8c77-d19c44234dcb",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-11966 affects version 4.5.10-tuxcare.3 of io.vertx:vertx-web."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/io.vertx/vertx-web@4.5.10-tuxcare.3"
    }
  ]
}