{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:854f95a2-446f-5e3a-860a-087ac2aa15af",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@angular/common",
      "purl": "pkg:npm/%40angular/common@4.3.5-tuxcare.8",
      "type": "library",
      "bom-ref": "pkg:npm/%40angular/common@4.3.5-tuxcare.8",
      "version": "4.3.5-tuxcare.8",
      "pedigree": {
        "ancestors": [
          {
            "name": "@angular/common",
            "purl": "pkg:npm/%40angular/common@4.3.5",
            "type": "library",
            "version": "4.3.5"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2025-66035",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@4.3.5-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:09832b4a-af55-585c-8a3c-ae46bad12808",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-66035 is fixed in version 4.3.5-tuxcare.8 of @angular/common."
      }
    },
    {
      "id": "CVE-2026-111753",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@4.3.5-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:195c40bc-d945-5f93-8edd-b877b9a39439",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-111753 affects version 4.3.5-tuxcare.8 of @angular/common."
      }
    },
    {
      "id": "CVE-2026-50170",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@4.3.5-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:aa7f6679-0f56-5268-b1c9-325eefa1c7a3",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-50170 does not affect version 4.3.5-tuxcare.8 of @angular/common. not_affected \u2014 no evidence captured",
        "justification": "code_not_reachable"
      }
    },
    {
      "id": "CVE-2026-50171",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@4.3.5-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:66706031-b6be-5858-bd09-0c705b00336b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-50171 does not affect version 4.3.5-tuxcare.8 of @angular/common. not_affected \u2014 Angular 4.3.5 is not affected by CVE-2026-50171. This version uses the native Intl.NumberFormat API which has built-in ECMAScript-specified bounds checking (minimumIntegerDigits: 1-21, fractionDigits: 0-20). When large digit values are provided, Intl.NumberFormat throws a RangeError instead of causing resource exhaustion. The vulnerable roundNumber function with unbounded array allocation exist...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-54266",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@4.3.5-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:d44239d7-906a-5df4-ad23-c9281d55cf75",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-54266 does not affect version 4.3.5-tuxcare.8 of @angular/common. not_affected \u2014 Angular 4.3.5 is NOT affected by CVE-2026-54266. The vulnerable HttpTransferCache feature does not exist in this version - it was introduced in Angular v16+. Without the transfer cache mechanism, there is no hash function to collide, no cache to poison, and no attack surface for this vulnerability.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-54268",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@4.3.5-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:f05046f1-73e3-57d6-b542-0ecf875b2bb0",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-54268 is fixed in version 4.3.5-tuxcare.8 of @angular/common."
      }
    },
    {
      "id": "CVE-2026-68945",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@4.3.5-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:e65292ed-2d2d-57f2-b66a-6f35e7f60112",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-68945 does not affect version 4.3.5-tuxcare.8 of @angular/common. not_affected \u2014 Angular 4.3.5 is not affected by CVE-2026-68945. The vulnerable component HttpTransferCache was introduced in Angular v16, while this version (4.3.5) predates it by many years. While Angular 4.3.5 has HttpClient that receives HTTP request parameters (the INPUT), it lacks the HttpTransferCache component required to generate cache keys, making cache key collisions impossible. The chain from INPUT...",
        "justification": "code_not_reachable"
      }
    },
    {
      "id": "CVE-2026-88059",
      "affects": [
        {
          "ref": "pkg:npm/%40angular/common@4.3.5-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:0b1312e4-04a9-5efe-8d79-66bdcd6e0657",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-88059 does not affect version 4.3.5-tuxcare.8 of @angular/common. not_affected \u2014 Angular 4.3.5-tuxcare.5 is NOT AFFECTED by CVE-2026-88059. The vulnerability requires HttpTransferCache, hierarchical HttpClient with withRequestsMadeViaParent(), TransferState serialization, and SSR hydration - all features introduced in Angular 15-16 (2022-2023), years after this version from 2017. The entire vulnerable subsystem (transfer_cache.ts interceptor) does not exist in v4.3.5. Analy...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40angular/common@4.3.5-tuxcare.8"
    }
  ]
}