{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:f9ab1989-a6b8-5bd0-b8af-5927157c986c",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "json-smart",
      "purl": "pkg:maven/net.minidev/json-smart@2.4.7-tuxcare.1",
      "type": "library",
      "group": "net.minidev",
      "bom-ref": "pkg:maven/net.minidev/json-smart@2.4.7-tuxcare.1",
      "version": "2.4.7-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "json-smart",
            "purl": "pkg:maven/net.minidev/json-smart@2.4.7",
            "type": "library",
            "group": "net.minidev",
            "version": "2.4.7"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2021-27568",
      "affects": [
        {
          "ref": "pkg:maven/net.minidev/json-smart@2.4.7-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:eacf855a-c10e-5590-b4f7-58502fe8a514",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-27568 does not affect version 2.4.7-tuxcare.1 of net.minidev:json-smart. not_affected \u2014 CVE-2021-27568 is NOT present in json-smart 2.4.7-tuxcare.1. The vulnerability concerns uncaught NumberFormatException during JSON number parsing. The upstream version 2.4.7 already shipped with the fix (commit c8133d2 by tmayer@it-sec.de, Feb 26 2021) that wraps Float.parseFloat(), BigDecimal(), and Double.parseDouble() calls in try-catch blocks within JSONParserBase.extractFloat(). This fix p...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-31684",
      "affects": [
        {
          "ref": "pkg:maven/net.minidev/json-smart@2.4.7-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:c9518bda-911d-5432-95d6-6ad7c05bde4b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-31684 does not affect version 2.4.7-tuxcare.1 of net.minidev:json-smart. CVE-2021-31684 is NOT present in this target. The vulnerability was an infinite loop bug in JSONParserByteArray.indexOf() where the loop condition incorrectly checked 'pos < len' instead of 'i < len', causing unbounded resource consumption. The fix was applied by upstream author HAPPY (pcy190@126.com) in commit 6ecff1c on 2021-04-16 and shipped in upstream release 2.4.7. TuxCare onboarded version 2.4.7 on 2026-09-19, inheriting the fix. The current code at line 80 has the correct loop condition 'for (int i = pos; i < len; i++)'.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.3.0, < 1.3.3; >= 2.4.0, < 2.4.4), NVD (>= 1.3, < 1.3.3; >= 2.4, < 2.4.4), Snyk (>= 0, < 1.3.3; >= 2.0.0, < 2.4.5).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-1370",
      "affects": [
        {
          "ref": "pkg:maven/net.minidev/json-smart@2.4.7-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:ecbb4eab-a356-5be5-8d93-f07c95faad87",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2023-1370 is fixed in version 2.4.7-tuxcare.1 of net.minidev:json-smart."
      }
    },
    {
      "id": "CVE-2024-57699",
      "affects": [
        {
          "ref": "pkg:maven/net.minidev/json-smart@2.4.7-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:8a63235d-8e1c-5042-85d4-8c7e44684d5b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-57699 affects version 2.4.7-tuxcare.1 of net.minidev:json-smart."
      }
    },
    {
      "id": "CVE-2026-113602",
      "affects": [
        {
          "ref": "pkg:maven/net.minidev/json-smart@2.4.7-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:01b6531c-c9ee-570f-83d3-4ce1a5fd9fa2",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-113602 affects version 2.4.7-tuxcare.1 of net.minidev:json-smart."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/net.minidev/json-smart@2.4.7-tuxcare.1"
    }
  ]
}