{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:6cce6af4-5cde-549b-8fbd-cbce1ba60a4b", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "framework", "purl": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare", "type": "library", "group": "laravel", "bom-ref": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare", "version": "5.5.50-p4+tuxcare", "pedigree": { "ancestors": [ { "name": "framework", "purl": "pkg:composer/laravel/framework@5.5.50", "type": "library", "group": "laravel", "version": "5.5.50" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2017-14775", "affects": [ { "ref": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare" } ], "bom-ref": "urn:uuid:ef26e0c7-f1bd-561d-9bf3-9321134e1df7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-14775 does not affect version 5.5.50-p4+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 is NOT present in Laravel 5.5.50-p4+tuxcare. The vulnerability affected Laravel before 5.5.10 due to non-constant-time token comparison in DatabaseUserProvider and EloquentUserProvider. The target version (5.5.50) already contains the upstream fix that was applied in Laravel 5.5.10, which replaced database-level string comparison with hash_equals() for constant-time comparison. T...", "justification": "code_not_present" } }, { "id": "CVE-2018-15133", "affects": [ { "ref": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare" } ], "bom-ref": "urn:uuid:69428135-31db-5182-991a-2597d54d96f0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-15133 does not affect version 5.5.50-p4+tuxcare of laravel/framework. Version 5.5.50 is not vulnerable. Summary: The target Laravel Framework v5.5.50-p2+tuxcare is NOT vulnerable to CVE-2018-15133. While the X-XSRF-TOKEN decryption feature exists, the vulnerable code pattern does not. The fix has been properly applied: the decrypt() method is called with false as the second parameter (via static::serialized()), preventing unsafe deserialization of the X-XSRF-TOKEN header value.", "justification": "code_not_present" } }, { "id": "CVE-2019-9081", "affects": [ { "ref": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare" } ], "bom-ref": "urn:uuid:7cfd1249-7d10-5a70-9f26-e33466506be1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-9081 affects version 5.5.50-p4+tuxcare of laravel/framework." } }, { "id": "CVE-2020-19316", "affects": [ { "ref": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare" } ], "bom-ref": "urn:uuid:97e6a5ae-46c9-5235-9541-6793b284a88a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-19316 is fixed in version 5.5.50-p4+tuxcare of laravel/framework." } }, { "id": "CVE-2020-24941", "affects": [ { "ref": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare" } ], "bom-ref": "urn:uuid:4c45b24f-bcc0-56ee-ac31-b1eed5ae3cf2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-24941 is fixed in version 5.5.50-p4+tuxcare of laravel/framework." } }, { "id": "CVE-2021-21263", "affects": [ { "ref": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare" } ], "bom-ref": "urn:uuid:f716c024-f377-5d93-82d8-f3ef1b8f3e26", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-21263 is fixed in version 5.5.50-p4+tuxcare of laravel/framework." } }, { "id": "CVE-2021-43503", "affects": [ { "ref": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare" } ], "bom-ref": "urn:uuid:54273613-c59a-5dbb-ad3e-8a1bbd77b389", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2021-43503 is a false positive for laravel/framework 5.5.50-p4+tuxcare. CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed." } }, { "id": "CVE-2021-43617", "affects": [ { "ref": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare" } ], "bom-ref": "urn:uuid:6bb21314-13fe-50bc-b2b7-882c470f77de", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-43617 is fixed in version 5.5.50-p4+tuxcare of laravel/framework." } }, { "id": "CVE-2021-43808", "affects": [ { "ref": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare" } ], "bom-ref": "urn:uuid:f94f64e7-6cab-5c7d-9467-dbc7f4084374", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-43808 is fixed in version 5.5.50-p4+tuxcare of laravel/framework." } }, { "id": "CVE-2022-31279", "affects": [ { "ref": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare" } ], "bom-ref": "urn:uuid:31783fec-b35d-5676-b581-e1896371d2f7", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2022-31279 is a false positive for laravel/framework 5.5.50-p4+tuxcare. CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"" } }, { "id": "CVE-2024-52301", "affects": [ { "ref": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare" } ], "bom-ref": "urn:uuid:575ed47f-c56e-5402-beb8-861a28ce0340", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-52301 is fixed in version 5.5.50-p4+tuxcare of laravel/framework." } }, { "id": "CVE-2025-27515", "affects": [ { "ref": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare" } ], "bom-ref": "urn:uuid:e0706ad0-614d-57d5-a2d2-bc0e67335954", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-27515 is fixed in version 5.5.50-p4+tuxcare of laravel/framework." } }, { "id": "CVE-2026-102279", "affects": [ { "ref": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare" } ], "bom-ref": "urn:uuid:e7385da8-e931-575f-8efa-9a68a0c8a8c4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-102279 does not affect version 5.5.50-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.5.50 is not affected by CVE-2026-102279. The vulnerability exists in Laravel's custom exception renderer with Tippy.js tooltips, which was introduced in later versions (present in Laravel 12.x). Laravel 5.5.50 uses a completely different exception rendering architecture based on Whoops or Symfony ExceptionHandler, and does not contain the vulnerable component. The entire `src/Illumina...", "justification": "code_not_present" } }, { "id": "CVE-2026-114508", "affects": [ { "ref": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare" } ], "bom-ref": "urn:uuid:cf1b1fe9-03fd-58ba-afe4-4f05386c0e05", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-114508 does not affect version 5.5.50-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.5.50 is not affected by CVE-2026-114508. The vulnerability requires JsonAPI Resources support (Illuminate\\Http\\Resources\\JsonApi\\*), which was introduced in much later versions of Laravel (10+). Laravel 5.5 only has basic JSON Resources (Illuminate\\Http\\Resources\\Json\\*) that do not parse ?include= query parameters for relationship loading. While the underlying Eloquent ORM could theo...", "justification": "code_not_present" } }, { "id": "CVE-2026-114509", "affects": [ { "ref": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare" } ], "bom-ref": "urn:uuid:fb1da7cb-3bcb-5fa1-b95b-1c01376aec62", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-114509 affects version 5.5.50-p4+tuxcare of laravel/framework." } }, { "id": "GHSA-4mg9-vhxq-vm7j", "affects": [ { "ref": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare" } ], "bom-ref": "urn:uuid:8dfbf167-d8b7-5b4f-9f92-6f1589401cf7", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 5.5.50-p4+tuxcare of laravel/framework." } }, { "id": "GHSA-5vg9-5847-vvmq", "affects": [ { "ref": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare" } ], "bom-ref": "urn:uuid:07796e67-4520-5973-aff4-7e2197c176f9", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-5vg9-5847-vvmq does not affect version 5.5.50-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.5.50 uses SwiftMailer v6.3.0, not Symfony Mailer. The CVE explicitly describes a combination vulnerability requiring both Laravel's missing CRLF validation AND Symfony Mailer/Mime's specific handling of CRLF characters. Since the target uses a different mail library (SwiftMailer), the specific attack chain described in the CVE cannot be completed.", "justification": "code_not_present" } }, { "id": "GHSA-6jvx-8ch9-j2jr", "affects": [ { "ref": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare" } ], "bom-ref": "urn:uuid:824bd4ff-e7ef-5783-8a8e-1cbed7373fef", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 5.5.50-p4+tuxcare of laravel/framework. Version 5.5.50 is not vulnerable. Summary: The target repository (Laravel 5.5.50-p2+tuxcare) is NOT VULNERABLE to GHSA-6jvx-8ch9-j2jr (PHP object injection via cookie serialization). The repository has been patched with a global serialization disable mechanism that is more secure than the vendor's original selective fix.", "justification": "code_not_present" } }, { "id": "GHSA-7852-w36x-6mf6", "affects": [ { "ref": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare" } ], "bom-ref": "urn:uuid:06806c52-eee3-5939-a951-982ea04c8f1b", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 5.5.50-p4+tuxcare of laravel/framework. not_affected \u2014 The target Laravel Framework 5.5.50-p4+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The IV length validation fix is present in the code (src/Illuminate/Encryption/Encrypter.php lines 209-210), preventing manipulated payloads with wrong-length IVs from causing decryption to return false. This fix was already included in the upstream Laravel 5.5.50 release (committed by Taylor Otwell in March ...", "justification": "code_not_present" } }, { "id": "GHSA-crmm-hgp2-wgrp", "affects": [ { "ref": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare" } ], "bom-ref": "urn:uuid:4701a6b2-d8cf-555b-a448-1920a0c0e2ee", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 5.5.50-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.5.50 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects Laravel's LocalFilesystemAdapter class and its built-in local filesystem temporary URL generation feature, which was introduced in Laravel 11.x and does not exist in Laravel 5.x.", "justification": "code_not_present" } }, { "id": "GHSA-jwvj-pwww-3mj5", "affects": [ { "ref": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare" } ], "bom-ref": "urn:uuid:3554b330-c271-5779-8952-68cce892e8a7", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.5.50-p4+tuxcare of laravel/framework." } }, { "id": "GHSA-qm5c-m76r-2hfr", "affects": [ { "ref": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare" } ], "bom-ref": "urn:uuid:ab463440-009f-53ba-8839-46606bba5101", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-qm5c-m76r-2hfr is fixed in version 5.5.50-p4+tuxcare of laravel/framework." } }, { "id": "GHSA-wq8p-mqvg-2p5h", "affects": [ { "ref": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare" } ], "bom-ref": "urn:uuid:7c3d0324-90d4-50f9-8c75-527e8ef995a3", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.5.50-p4+tuxcare of laravel/framework." } }, { "id": "GHSA-x7p5-p2c9-phvg", "affects": [ { "ref": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare" } ], "bom-ref": "urn:uuid:cec87b8b-9fe7-5a33-9005-8dbef5f33e26", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 5.5.50-p4+tuxcare of laravel/framework." } } ], "dependencies": [ { "ref": "pkg:composer/laravel/framework@5.5.50-p4+tuxcare" } ] }