{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:70128bd5-17ed-563d-beeb-cf4afa653c45",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "HdrHistogram",
      "purl": "pkg:maven/org.hdrhistogram/HdrHistogram@2.1.8-tuxcare.1",
      "type": "library",
      "group": "org.hdrhistogram",
      "bom-ref": "pkg:maven/org.hdrhistogram/HdrHistogram@2.1.8-tuxcare.1",
      "version": "2.1.8-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "HdrHistogram",
            "purl": "pkg:maven/org.hdrhistogram/HdrHistogram@2.1.8",
            "type": "library",
            "group": "org.hdrhistogram",
            "version": "2.1.8"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-14683",
      "affects": [
        {
          "ref": "pkg:maven/org.hdrhistogram/HdrHistogram@2.1.8-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:fc185351-bdd0-5c00-b44f-35005cdae359",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-14683 is fixed in version 2.1.8-tuxcare.1 of org.hdrhistogram:HdrHistogram."
      }
    },
    {
      "id": "CVE-2026-14684",
      "affects": [
        {
          "ref": "pkg:maven/org.hdrhistogram/HdrHistogram@2.1.8-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:a070da22-7574-5da8-8adb-0b06aff6069e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-14684 does not affect version 2.1.8-tuxcare.1 of org.hdrhistogram:HdrHistogram. not_affected \u2014 CVE-2026-14684 claims HdrHistogram versions up to 2.2.2 are vulnerable to uncontrolled memory allocation via the numberOfSignificantValueDigits parameter in AbstractHistogram.decodeFromByteBuffer. However, version 2.1.8 contains upstream validation (added in 2012 by Gil Tene) that restricts numberOfSignificantValueDigits to the range 0-5, preventing excessive memory allocation. The validation o...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-14685",
      "affects": [
        {
          "ref": "pkg:maven/org.hdrhistogram/HdrHistogram@2.1.8-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:1e437b45-7f22-5841-81a3-be6f9b849b65",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-14685 affects version 2.1.8-tuxcare.1 of org.hdrhistogram:HdrHistogram."
      }
    },
    {
      "id": "CVE-2026-14686",
      "affects": [
        {
          "ref": "pkg:maven/org.hdrhistogram/HdrHistogram@2.1.8-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:8c783070-42a3-5811-a085-7b7be83d6ef6",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-14686 does not affect version 2.1.8-tuxcare.1 of org.hdrhistogram:HdrHistogram. not_affected \u2014 The target version 2.1.8 is NOT AFFECTED by CVE-2026-14686. The vulnerability (incorrect comparison using '>' instead of '>=' in range check) was fixed by upstream vendor (Gil Tene) in commit a26bb1f on May 27, 2015, before the 2.1.8 release. The fix is present in the target code at lines 331 and 342 of DoubleHistogram.java, both correctly using '>=' for the upper bound check. This is a vendor-...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.hdrhistogram/HdrHistogram@2.1.8-tuxcare.1"
    }
  ]
}