{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:f97aa14d-75fe-5f47-8df1-dc912f6b4cc5",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "bcutil-debug-jdk18on",
      "purl": "pkg:maven/org.bouncycastle/bcutil-debug-jdk18on@1.78.1-tuxcare.6",
      "type": "library",
      "group": "org.bouncycastle",
      "bom-ref": "pkg:maven/org.bouncycastle/bcutil-debug-jdk18on@1.78.1-tuxcare.6",
      "version": "1.78.1-tuxcare.6",
      "pedigree": {
        "ancestors": [
          {
            "name": "bcutil-debug-jdk18on",
            "purl": "pkg:maven/org.bouncycastle/bcutil-debug-jdk18on@1.78.1",
            "type": "library",
            "group": "org.bouncycastle",
            "version": "1.78.1"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2023-33201",
      "affects": [
        {
          "ref": "pkg:maven/org.bouncycastle/bcutil-debug-jdk18on@1.78.1-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:2bd92217-ee95-59cf-b663-14aeb9b3e2d4",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-33201 affects version 1.78.1-tuxcare.6 of org.bouncycastle:bcutil-debug-jdk18on."
      }
    },
    {
      "id": "CVE-2023-33202",
      "affects": [
        {
          "ref": "pkg:maven/org.bouncycastle/bcutil-debug-jdk18on@1.78.1-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:a010d776-5b6f-5ae9-95ad-ba33a18d9e75",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-33202 affects version 1.78.1-tuxcare.6 of org.bouncycastle:bcutil-debug-jdk18on."
      }
    },
    {
      "id": "CVE-2024-29857",
      "affects": [
        {
          "ref": "pkg:maven/org.bouncycastle/bcutil-debug-jdk18on@1.78.1-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:ee8bc7b9-f276-53ae-9e36-088adddbae69",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-29857 affects version 1.78.1-tuxcare.6 of org.bouncycastle:bcutil-debug-jdk18on."
      }
    },
    {
      "id": "CVE-2024-30171",
      "affects": [
        {
          "ref": "pkg:maven/org.bouncycastle/bcutil-debug-jdk18on@1.78.1-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:f0d1eec5-d3b4-56d0-adb1-dd29442ae2e1",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-30171 affects version 1.78.1-tuxcare.6 of org.bouncycastle:bcutil-debug-jdk18on."
      }
    },
    {
      "id": "CVE-2024-30172",
      "affects": [
        {
          "ref": "pkg:maven/org.bouncycastle/bcutil-debug-jdk18on@1.78.1-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:8015f6c1-f2c8-51a2-9245-329e7c7c8cc3",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-30172 affects version 1.78.1-tuxcare.6 of org.bouncycastle:bcutil-debug-jdk18on."
      }
    },
    {
      "id": "CVE-2024-34447",
      "affects": [
        {
          "ref": "pkg:maven/org.bouncycastle/bcutil-debug-jdk18on@1.78.1-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:6dca0a7a-2f28-5f45-a607-03be63903ec5",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-34447 does not affect version 1.78.1-tuxcare.6 of org.bouncycastle:bcutil-debug-jdk18on. Version 1.78.1 is not vulnerable. Summary: CVE-2024-34447 is NOT present in this Bouncy Castle 1.78.1 codebase. The vulnerability was fixed in commit c47f6444a on April 3, 2024, and this fix is present in the current version. The fix prevents hostname verification from being performed against DNS-resolved IP addresses by setting peerHost to null instead of an IP address when in client mode without trusting the name service. [terminalized not_affected from patch_application_manual/not_vulnerable]",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-14813",
      "affects": [
        {
          "ref": "pkg:maven/org.bouncycastle/bcutil-debug-jdk18on@1.78.1-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:63a25536-8737-576d-95df-60b952477fd6",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-14813 is fixed in version 1.78.1-tuxcare.6 of org.bouncycastle:bcutil-debug-jdk18on."
      }
    },
    {
      "id": "CVE-2025-8885",
      "affects": [
        {
          "ref": "pkg:maven/org.bouncycastle/bcutil-debug-jdk18on@1.78.1-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:75b976bb-fdde-54cf-ab8a-ea8b1a097537",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-8885 affects version 1.78.1-tuxcare.6 of org.bouncycastle:bcutil-debug-jdk18on."
      }
    },
    {
      "id": "CVE-2026-0636",
      "affects": [
        {
          "ref": "pkg:maven/org.bouncycastle/bcutil-debug-jdk18on@1.78.1-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:103d7de8-2d58-5aa5-9600-c697d47def8e",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-0636 is fixed in version 1.78.1-tuxcare.6 of org.bouncycastle:bcutil-debug-jdk18on."
      }
    },
    {
      "id": "CVE-2026-13506",
      "affects": [
        {
          "ref": "pkg:maven/org.bouncycastle/bcutil-debug-jdk18on@1.78.1-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:6d2c8105-4940-5a33-b0e9-6003234862ed",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-13506 affects version 1.78.1-tuxcare.6 of org.bouncycastle:bcutil-debug-jdk18on, and is fixed in 1.78.1-tuxcare.9."
      }
    },
    {
      "id": "CVE-2026-5598",
      "affects": [
        {
          "ref": "pkg:maven/org.bouncycastle/bcutil-debug-jdk18on@1.78.1-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:197853d5-04de-563f-a4e6-32e025a7ebd0",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-5598 is fixed in version 1.78.1-tuxcare.6 of org.bouncycastle:bcutil-debug-jdk18on."
      }
    },
    {
      "id": "CVE-2026-8763",
      "affects": [
        {
          "ref": "pkg:maven/org.bouncycastle/bcutil-debug-jdk18on@1.78.1-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:ffc32a30-b0f8-52b6-9455-2c372201591b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-8763 affects version 1.78.1-tuxcare.6 of org.bouncycastle:bcutil-debug-jdk18on, and is fixed in 1.78.1-tuxcare.9."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.bouncycastle/bcutil-debug-jdk18on@1.78.1-tuxcare.6"
    }
  ]
}