{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:56a130b8-90a7-5346-bdfc-4cb633c98df4", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "async-http-client", "purl": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.1", "type": "library", "group": "org.asynchttpclient", "bom-ref": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.1", "version": "2.12.3-tuxcare.1", "pedigree": { "ancestors": [ { "name": "async-http-client", "purl": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3", "type": "library", "group": "org.asynchttpclient", "version": "2.12.3" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2017-14063", "affects": [ { "ref": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.1" } ], "bom-ref": "urn:uuid:4b79b90e-be65-506e-83c8-3223a8ef8b1e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-14063 does not affect version 2.12.3-tuxcare.1 of org.asynchttpclient:async-http-client. The target repository (async-http-client 2.12.3-tuxcare.1) is NOT affected by CVE-2017-14063. The vulnerability, which allowed URL parsing confusion when a '?' character appears in a fragment identifier, was fixed in the upstream release before TuxCare onboarded version 2.12.3. The fix commit (eb9e3347e) authored by Stephane Landelle (slandelle@gatling.io) is present in HEAD and was part of the upstream release 2.12.3 that TuxCare onboarded. The vulnerable code pattern (parsing query before trimming fragment) is not present; the current code correctly trims the fragment before searching for the query delimiter.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.35), NVD (< 2.0.35), Snyk (< 2.0.35; < 2.0.35).", "justification": "code_not_present" } }, { "id": "CVE-2024-53990", "affects": [ { "ref": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.1" } ], "bom-ref": "urn:uuid:22f3c62a-368b-5a50-984b-ec2da107906d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-53990 affects version 2.12.3-tuxcare.1 of org.asynchttpclient:async-http-client, and is fixed in 2.12.3-tuxcare.2." } }, { "id": "CVE-2026-107226", "affects": [ { "ref": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.1" } ], "bom-ref": "urn:uuid:1b32a9d1-a5fb-5aef-be63-eb453493371d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-107226 affects version 2.12.3-tuxcare.1 of org.asynchttpclient:async-http-client, and is fixed in 2.12.3-tuxcare.2." } }, { "id": "CVE-2026-107227", "affects": [ { "ref": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.1" } ], "bom-ref": "urn:uuid:a41e9d28-9f57-510c-9064-7c9d982f5a84", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-107227 affects version 2.12.3-tuxcare.1 of org.asynchttpclient:async-http-client, and is fixed in 2.12.3-tuxcare.2." } }, { "id": "CVE-2026-107228", "affects": [ { "ref": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.1" } ], "bom-ref": "urn:uuid:61622a49-6426-5c42-9a82-2753199b7a26", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-107228 affects version 2.12.3-tuxcare.1 of org.asynchttpclient:async-http-client, and is fixed in 2.12.3-tuxcare.2." } }, { "id": "CVE-2026-107230", "affects": [ { "ref": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.1" } ], "bom-ref": "urn:uuid:381ae19c-378d-520d-825a-29bed01443fc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-107230 affects version 2.12.3-tuxcare.1 of org.asynchttpclient:async-http-client, and is fixed in 2.12.3-tuxcare.2." } }, { "id": "CVE-2026-107231", "affects": [ { "ref": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.1" } ], "bom-ref": "urn:uuid:9cec7f53-da4b-5024-bac6-3692b7cef07f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-107231 affects version 2.12.3-tuxcare.1 of org.asynchttpclient:async-http-client, and is fixed in 2.12.3-tuxcare.2." } }, { "id": "CVE-2026-107280", "affects": [ { "ref": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.1" } ], "bom-ref": "urn:uuid:eef0c682-555e-5ae7-b6ec-143f549dad4a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-107280 affects version 2.12.3-tuxcare.1 of org.asynchttpclient:async-http-client, and is fixed in 2.12.3-tuxcare.2." } }, { "id": "CVE-2026-107282", "affects": [ { "ref": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.1" } ], "bom-ref": "urn:uuid:523f770c-13d4-5960-8a34-b400a133e390", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-107282 affects version 2.12.3-tuxcare.1 of org.asynchttpclient:async-http-client, and is fixed in 2.12.3-tuxcare.2." } }, { "id": "CVE-2026-107283", "affects": [ { "ref": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.1" } ], "bom-ref": "urn:uuid:f0742005-8ebd-53de-8a83-41d9b67fec11", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-107283 affects version 2.12.3-tuxcare.1 of org.asynchttpclient:async-http-client, and is fixed in 2.12.3-tuxcare.2." } }, { "id": "CVE-2026-107285", "affects": [ { "ref": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.1" } ], "bom-ref": "urn:uuid:4bdcc22b-18ab-5480-a617-0f7f79f0bd56", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-107285 affects version 2.12.3-tuxcare.1 of org.asynchttpclient:async-http-client, and is fixed in 2.12.3-tuxcare.2." } }, { "id": "CVE-2026-40490", "affects": [ { "ref": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.1" } ], "bom-ref": "urn:uuid:1c8817a1-436e-5f60-9d1f-6f68db736a52", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-40490 affects version 2.12.3-tuxcare.1 of org.asynchttpclient:async-http-client, and is fixed in 2.12.3-tuxcare.2." } }, { "id": "CVE-2026-45300", "affects": [ { "ref": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.1" } ], "bom-ref": "urn:uuid:f4c668cd-bdac-53fc-980a-0737d6554d0a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-45300 affects version 2.12.3-tuxcare.1 of org.asynchttpclient:async-http-client, and is fixed in 2.12.3-tuxcare.2." } }, { "id": "CVE-2026-55688", "affects": [ { "ref": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.1" } ], "bom-ref": "urn:uuid:a7393562-a147-50f2-a7e8-50ea7d6f9317", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-55688 affects version 2.12.3-tuxcare.1 of org.asynchttpclient:async-http-client, and is fixed in 2.12.3-tuxcare.2." } }, { "id": "CVE-2026-85716", "affects": [ { "ref": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.1" } ], "bom-ref": "urn:uuid:37aa2ed7-3e73-5bf5-902e-63cde8c66cda", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-85716 does not affect version 2.12.3-tuxcare.1 of org.asynchttpclient:async-http-client. not_affected \u2014 Target version 2.12.3 is NOT affected by CVE-2026-85716. The CVE explicitly excludes the 2.x line, stating \"The 2.x line is not affected either: it has no SCRAM support, and its interceptor chain does not implement Digest mutual authentication, so there is no verification result to act on.\" Code inspection confirms: (1) No SCRAM support - Realm.AuthScheme enum contains only BASIC, DIGEST, NTLM,...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-85717", "affects": [ { "ref": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.1" } ], "bom-ref": "urn:uuid:af7a04e6-1290-5b94-8bf7-2beb1f6a0bf0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-85717 does not affect version 2.12.3-tuxcare.1 of org.asynchttpclient:async-http-client. not_affected \u2014 Version 2.12.3 is NOT affected by CVE-2026-85717. This CVE describes a RESIDUAL vulnerability that bypasses the cross-origin credential strip introduced by GHSA-cmxv-58fp-fm3g. Version 2.12.3 predates that strip mechanism (affected versions: 2.14.5-2.16.0), so the specific bypass chain this CVE addresses cannot occur. The CVE explicitly states: \"Releases below those floors are covered by the ea...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-85720", "affects": [ { "ref": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.1" } ], "bom-ref": "urn:uuid:ed20bba9-a2f3-5b4f-883f-4f645c96c6fc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-85720 affects version 2.12.3-tuxcare.1 of org.asynchttpclient:async-http-client, and is fixed in 2.12.3-tuxcare.2." } }, { "id": "CVE-2026-85721", "affects": [ { "ref": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.1" } ], "bom-ref": "urn:uuid:34c5cc25-23da-5bb9-aace-b8dc7b5bacd6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-85721 affects version 2.12.3-tuxcare.1 of org.asynchttpclient:async-http-client, and is fixed in 2.12.3-tuxcare.2." } }, { "id": "GHSA-cmxv-58fp-fm3g", "affects": [ { "ref": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.1" } ], "bom-ref": "urn:uuid:c594516e-119d-5e50-8351-dd0cf9b62cbb", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-cmxv-58fp-fm3g affects version 2.12.3-tuxcare.1 of org.asynchttpclient:async-http-client, and is fixed in 2.12.3-tuxcare.2." } } ], "dependencies": [ { "ref": "pkg:maven/org.asynchttpclient/async-http-client@2.12.3-tuxcare.1" } ] }