{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:3fe61d3a-507a-5f05-ae04-0c2ef8803646",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "tomcat-servlet-api",
      "purl": "pkg:maven/org.apache.tomcat/tomcat-servlet-api@10.1.50-tuxcare.3",
      "type": "library",
      "group": "org.apache.tomcat",
      "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-servlet-api@10.1.50-tuxcare.3",
      "version": "10.1.50-tuxcare.3",
      "pedigree": {
        "ancestors": [
          {
            "name": "tomcat-servlet-api",
            "purl": "pkg:maven/org.apache.tomcat/tomcat-servlet-api@10.1.50",
            "type": "library",
            "group": "org.apache.tomcat",
            "version": "10.1.50"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2001-0590",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-servlet-api@10.1.50-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:f7f8c766-541f-5f69-a6f2-d3963515f4a0",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2001-0590 does not affect version 10.1.50-tuxcare.3 of org.apache.tomcat:tomcat-servlet-api. not_affected \u2014 Tomcat 10.1.50 is not affected by CVE-2001-0590. While modern Tomcat accepts HTTP/0.9 requests (requests missing HTTP protocol specification), the vulnerable code path from Tomcat 3.x that enabled JSP source disclosure does not exist in the modern architecture. All requests, regardless of HTTP version, are routed through the unified servlet dispatch pipeline which maps *.jsp files to JspServlet...",
        "justification": "code_not_reachable"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.tomcat/tomcat-servlet-api@10.1.50-tuxcare.3"
    }
  ]
}