{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:8340e2ad-bedd-58dd-a592-f6b37c94e451",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "HdrHistogram",
      "purl": "pkg:maven/org.hdrhistogram/HdrHistogram@2.1.10-tuxcare.1",
      "type": "library",
      "group": "org.hdrhistogram",
      "bom-ref": "pkg:maven/org.hdrhistogram/HdrHistogram@2.1.10-tuxcare.1",
      "version": "2.1.10-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "HdrHistogram",
            "purl": "pkg:maven/org.hdrhistogram/HdrHistogram@2.1.10",
            "type": "library",
            "group": "org.hdrhistogram",
            "version": "2.1.10"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-14683",
      "affects": [
        {
          "ref": "pkg:maven/org.hdrhistogram/HdrHistogram@2.1.10-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:b38f89c7-809e-5959-a88a-a86584207cbd",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-14683 is fixed in version 2.1.10-tuxcare.1 of org.hdrhistogram:HdrHistogram."
      }
    },
    {
      "id": "CVE-2026-14684",
      "affects": [
        {
          "ref": "pkg:maven/org.hdrhistogram/HdrHistogram@2.1.10-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:566ed277-3b92-5408-98d1-03bfbd2b488d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-14684 does not affect version 2.1.10-tuxcare.1 of org.hdrhistogram:HdrHistogram. not_affected \u2014 HdrHistogram version 2.1.10 is not affected by CVE-2026-14684. The vulnerability describes uncontrolled memory allocation via manipulation of the numberOfSignificantValueDigits parameter in decodeFromByteBuffer. However, this version contains runtime validation (added in 2013) that restricts numberOfSignificantValueDigits to the range 0-5, preventing uncontrolled allocation. The validation is a...",
        "justification": "protected_at_runtime"
      }
    },
    {
      "id": "CVE-2026-14685",
      "affects": [
        {
          "ref": "pkg:maven/org.hdrhistogram/HdrHistogram@2.1.10-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:e69d6a3a-76e1-5dce-a740-ee37a814710a",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-14685 does not affect version 2.1.10-tuxcare.1 of org.hdrhistogram:HdrHistogram. not_affected \u2014 CVE-2026-14685 describes a state issue where recordValueWithCount() accepts arbitrary count values without validation. However, HdrHistogram is a data structure library (LIB) with no trust boundary of its own. The Mandatory Reachability Audit (MRA) shows no attacker-controllable entry point within the library's code. The count parameter is controlled by application code, not external attackers....",
        "justification": "code_not_reachable"
      }
    },
    {
      "id": "CVE-2026-14686",
      "affects": [
        {
          "ref": "pkg:maven/org.hdrhistogram/HdrHistogram@2.1.10-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:9d598af9-2ea2-5307-866a-68f3b194dafd",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-14686 does not affect version 2.1.10-tuxcare.1 of org.hdrhistogram:HdrHistogram. not_affected \u2014 HdrHistogram (org.hdrhistogram:HdrHistogram) IS the CVE's affected product, so not a false positive. CVE-2026-14686 is a disputed CWE-697 (CVSS 3.3-4.0 LOW, local, data-integrity-only): in DoubleHistogram.recordValue the range check `(value < currentLowestValueInAutoRange) || (value >= currentHighestValueLimitInAutoRange)` returns false for NaN/+-Infinity (IEEE-754), so a NaN skips auto-ranging and is recorded as bucket 0 (GitHub issue #222; PR #224 proposed isNaN/isInfinite guards). The exact pattern IS present in target 2.1.10 at DoubleHistogram.java:334 and :344 with no NaN/Infinity guard, so I do NOT rely on OSV's 'introduced 2.2.0 / affected 2.2.1-2.2.2' metadata (the pattern predates 2.2.0). However, HdrHistogram is a LIBRARY: recordValue/recordValueWithCount are public metrics-recording APIs consuming the caller's own measured values, not attacker input crossing a trust boundary. No production entry point in HdrHistogram's own source routes attacker-controlled NaN into recordValue: the only main() (HistogramLogProcessor CLI) never calls recordValue, and internal callers (add/subtract/recordValueWithExpectedInterval) pass only integer-derived doubles. Per the mandatory Reachability Audit, 'a downstream app could pass NaN' is not valid exposure, so the flawed comparison is not reachable from the target's own trust boundary -> not_affected (code_not_reachable). This matches the CVE's disputed rationale (no security-boundary crossing). [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-21; the earlier Sonnet run was parked by the author-verification gate after crediting a TuxCare backport for an upstream fix]",
        "justification": "code_not_reachable"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.hdrhistogram/HdrHistogram@2.1.10-tuxcare.1"
    }
  ]
}