{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:c35b35a0-5b2f-527a-bcc2-2c8eabf251c9",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "vertx-core",
      "purl": "pkg:maven/io.vertx/vertx-core@4.2.4-tuxcare.1",
      "type": "library",
      "group": "io.vertx",
      "bom-ref": "pkg:maven/io.vertx/vertx-core@4.2.4-tuxcare.1",
      "version": "4.2.4-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "vertx-core",
            "purl": "pkg:maven/io.vertx/vertx-core@4.2.4",
            "type": "library",
            "group": "io.vertx",
            "version": "4.2.4"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-12537",
      "affects": [
        {
          "ref": "pkg:maven/io.vertx/vertx-core@4.2.4-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:7cf85e8d-6022-5019-8481-bc3051b12184",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-12537 affects version 4.2.4-tuxcare.1 of io.vertx:vertx-core."
      }
    },
    {
      "id": "CVE-2018-12541",
      "affects": [
        {
          "ref": "pkg:maven/io.vertx/vertx-core@4.2.4-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:d90affed-130e-52a6-876d-371ed95db059",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-12541 affects version 4.2.4-tuxcare.1 of io.vertx:vertx-core."
      }
    },
    {
      "id": "CVE-2018-12544",
      "affects": [
        {
          "ref": "pkg:maven/io.vertx/vertx-core@4.2.4-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:ea2c1500-521b-518e-9c73-95c0aa3e51e2",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-12544 affects version 4.2.4-tuxcare.1 of io.vertx:vertx-core."
      }
    },
    {
      "id": "CVE-2024-1023",
      "affects": [
        {
          "ref": "pkg:maven/io.vertx/vertx-core@4.2.4-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:c1e90431-3669-52b3-b6c4-68513ef29d3a",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-1023 affects version 4.2.4-tuxcare.1 of io.vertx:vertx-core."
      }
    },
    {
      "id": "CVE-2024-1300",
      "affects": [
        {
          "ref": "pkg:maven/io.vertx/vertx-core@4.2.4-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:41e7b885-7f65-5980-8b92-ec216240cff1",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-1300 affects version 4.2.4-tuxcare.1 of io.vertx:vertx-core."
      }
    },
    {
      "id": "CVE-2026-1002",
      "affects": [
        {
          "ref": "pkg:maven/io.vertx/vertx-core@4.2.4-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:de97d766-c04a-51e6-836a-c4fe3cf7a60c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-1002 affects version 4.2.4-tuxcare.1 of io.vertx:vertx-core."
      }
    },
    {
      "id": "CVE-2026-6860",
      "affects": [
        {
          "ref": "pkg:maven/io.vertx/vertx-core@4.2.4-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:9ed6efeb-7372-5d73-bb44-ec2d9443af6e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-6860 does not affect version 4.2.4-tuxcare.1 of io.vertx:vertx-core. not_affected \u2014 Vert.x Core 4.2.4 is not affected by CVE-2026-6860. While the target processes SNI values and uses an unbounded ConcurrentHashMap for caching, the cache is keyed by Certificate objects (line 121-122: Map<Certificate, SslContext>) rather than by SNI name strings. This architectural difference prevents the vulnerability: multiple distinct attacker-controlled SNI names that map to the same wildcar...",
        "justification": "code_not_reachable"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/io.vertx/vertx-core@4.2.4-tuxcare.1"
    }
  ]
}