{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:e66e2508-a6cf-552e-a2bc-2911a36099f9", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "framework", "purl": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare", "type": "library", "group": "laravel", "bom-ref": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare", "version": "5.6.40-p3+tuxcare", "pedigree": { "ancestors": [ { "name": "framework", "purl": "pkg:composer/laravel/framework@5.6.40", "type": "library", "group": "laravel", "version": "5.6.40" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2017-14775", "affects": [ { "ref": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare" } ], "bom-ref": "urn:uuid:01814006-3a8b-5107-baa3-1de0e1f86a00", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-14775 does not affect version 5.6.40-p3+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 affects Laravel before 5.5.10 due to non-constant-time remember_me token comparison in DatabaseUserProvider and EloquentUserProvider. The target Laravel 5.6.40-p4+tuxcare already contains the upstream fix: both providers use hash_equals() for constant-time comparison with proper null checks. The fix was introduced in Laravel 5.5.10 (Sept 2017) and inherited by all subsequent rele...", "justification": "code_not_present" } }, { "id": "CVE-2018-15133", "affects": [ { "ref": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare" } ], "bom-ref": "urn:uuid:220071d9-5301-5f6e-ab34-03d849b6ff45", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15133 affects version 5.6.40-p3+tuxcare of laravel/framework." } }, { "id": "CVE-2019-9081", "affects": [ { "ref": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare" } ], "bom-ref": "urn:uuid:342f5ae0-5d3e-54ae-91fa-99fb065ae836", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-9081 affects version 5.6.40-p3+tuxcare of laravel/framework." } }, { "id": "CVE-2020-19316", "affects": [ { "ref": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare" } ], "bom-ref": "urn:uuid:900e72e4-f208-5335-829d-2f3177dfc98b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-19316 is fixed in version 5.6.40-p3+tuxcare of laravel/framework." } }, { "id": "CVE-2020-24941", "affects": [ { "ref": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare" } ], "bom-ref": "urn:uuid:29fcc729-53ff-5c09-987e-ebbd8ef42867", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-24941 is fixed in version 5.6.40-p3+tuxcare of laravel/framework." } }, { "id": "CVE-2021-21263", "affects": [ { "ref": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare" } ], "bom-ref": "urn:uuid:042016f1-ea67-513e-8cd8-bcc85f465235", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-21263 is fixed in version 5.6.40-p3+tuxcare of laravel/framework." } }, { "id": "CVE-2021-43503", "affects": [ { "ref": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare" } ], "bom-ref": "urn:uuid:96131f99-2bbb-580d-a918-4949d4446006", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2021-43503 is a false positive for laravel/framework 5.6.40-p3+tuxcare. CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed." } }, { "id": "CVE-2021-43617", "affects": [ { "ref": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare" } ], "bom-ref": "urn:uuid:89cbfef9-612d-59a5-a03e-299c98dfe9d6", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 5.6.40-p3+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" } }, { "id": "CVE-2021-43808", "affects": [ { "ref": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare" } ], "bom-ref": "urn:uuid:6dc916b2-56d9-50f4-a0d2-7c6d977c0a14", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-43808 is fixed in version 5.6.40-p3+tuxcare of laravel/framework." } }, { "id": "CVE-2022-31279", "affects": [ { "ref": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare" } ], "bom-ref": "urn:uuid:b51485d6-90ee-58ab-a9bb-01fd587a6b55", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2022-31279 is a false positive for laravel/framework 5.6.40-p3+tuxcare. CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"" } }, { "id": "CVE-2024-52301", "affects": [ { "ref": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare" } ], "bom-ref": "urn:uuid:01e03d5e-1458-5940-9eb5-dce08c155797", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-52301 is fixed in version 5.6.40-p3+tuxcare of laravel/framework." } }, { "id": "CVE-2025-27515", "affects": [ { "ref": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare" } ], "bom-ref": "urn:uuid:63abdd86-0016-5134-b7de-701ee68fbd34", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-27515 is fixed in version 5.6.40-p3+tuxcare of laravel/framework." } }, { "id": "CVE-2026-102279", "affects": [ { "ref": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare" } ], "bom-ref": "urn:uuid:d3f1f62e-a471-5487-ae51-51ad604d94d5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-102279 does not affect version 5.6.40-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.6.40 is not affected by CVE-2026-102279. The vulnerability exists in Laravel's custom exception renderer (introduced in Laravel 8+) which uses Tippy.js tooltips with allowHTML: true for displaying user-controlled data. Laravel 5.6.40 uses the Whoops library and Symfony's ExceptionHandler for exception rendering, not Laravel's custom renderer. The vulnerable code path (Tippy.js with al...", "justification": "code_not_present" } }, { "id": "CVE-2026-114508", "affects": [ { "ref": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare" } ], "bom-ref": "urn:uuid:551b4456-c56b-5550-96f1-9688e14543cb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-114508 does not affect version 5.6.40-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.6.40 does not contain the JSON:API resources feature that is affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API implementation (specifically in ResolvesJsonApiElements trait) which was introduced in Laravel 10+, approximately 4-5 major versions after 5.6. The target repository contains only basic JSON resources (Json\\JsonResource) but not JSON:API spec-complia...", "justification": "code_not_present" } }, { "id": "CVE-2026-114509", "affects": [ { "ref": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare" } ], "bom-ref": "urn:uuid:9e883007-87f3-531d-930e-950bf3ba1936", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-114509 affects version 5.6.40-p3+tuxcare of laravel/framework." } }, { "id": "GHSA-4mg9-vhxq-vm7j", "affects": [ { "ref": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare" } ], "bom-ref": "urn:uuid:6966f9f0-fadc-5095-82fd-bbfda476b3ba", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 5.6.40-p3+tuxcare of laravel/framework." } }, { "id": "GHSA-5vg9-5847-vvmq", "affects": [ { "ref": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare" } ], "bom-ref": "urn:uuid:98bb24c9-66d3-570f-9693-c199ab1923a1", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-5vg9-5847-vvmq does not affect version 5.6.40-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.6.40-p1+tuxcare uses SwiftMailer 6.3.0, not the Symfony Mailer targeted by GHSA-5vg9-5847-vvmq. SwiftMailer's Egulias EmailValidator provides CRLF validation that prevents the vulnerability pattern from manifesting.", "justification": "code_not_present" } }, { "id": "GHSA-6jvx-8ch9-j2jr", "affects": [ { "ref": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare" } ], "bom-ref": "urn:uuid:1d26c5de-9064-5430-a0be-04af4e8ae431", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 5.6.40-p3+tuxcare of laravel/framework. not_affected \u2014 Target Laravel 5.6.40-p4+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization vulnerability in cookies). The fix was included in upstream Laravel 5.6.30 and is present in 5.6.40. The EncryptCookies middleware enforces static::$serialize = false for all cookie encryption/decryption operations, preventing PHP object serialization attacks. Additional hardening in Recaller cla...", "justification": "protected_at_runtime" } }, { "id": "GHSA-7852-w36x-6mf6", "affects": [ { "ref": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare" } ], "bom-ref": "urn:uuid:fc8e8b2b-00ac-54fe-88e0-4b6f6eb37905", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 5.6.40-p3+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 5.6.40-p4+tuxcare is not affected by GHSA-7852-w36x-6mf6. The fix for the IV length validation vulnerability was shipped in the upstream Laravel 5.6.40 release, which TuxCare imported. The vulnerable code pattern (missing IV length check in the Encrypter's validPayload method) is not present; the fix validating that `strlen(base64_decode($payload['iv'], true)) === openssl_cip...", "justification": "code_not_present" } }, { "id": "GHSA-crmm-hgp2-wgrp", "affects": [ { "ref": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare" } ], "bom-ref": "urn:uuid:1cabdf3a-a9d2-5350-921f-e9581c261e75", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 5.6.40-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.6.40 does not have the vulnerable LocalFilesystemAdapter class or signed URL generation for local filesystem. The feature was introduced in Laravel 11+ (September 2024), years after this version. The FilesystemAdapter.temporaryUrl() method explicitly throws RuntimeException for local adapters - the feature is unsupported.", "justification": "code_not_present" } }, { "id": "GHSA-jwvj-pwww-3mj5", "affects": [ { "ref": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare" } ], "bom-ref": "urn:uuid:c5e759cb-2205-5cf3-9c39-1d775e76c4d3", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.6.40-p3+tuxcare of laravel/framework." } }, { "id": "GHSA-qm5c-m76r-2hfr", "affects": [ { "ref": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare" } ], "bom-ref": "urn:uuid:c7658072-80da-5dc8-86c6-ecdaa81e52eb", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-qm5c-m76r-2hfr is fixed in version 5.6.40-p3+tuxcare of laravel/framework." } }, { "id": "GHSA-wq8p-mqvg-2p5h", "affects": [ { "ref": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare" } ], "bom-ref": "urn:uuid:7701f4c6-9971-5dca-ae08-6cae9af74967", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.6.40-p3+tuxcare of laravel/framework." } }, { "id": "GHSA-x7p5-p2c9-phvg", "affects": [ { "ref": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare" } ], "bom-ref": "urn:uuid:aaedcffb-c3ac-5f9b-bf88-3994d42ef0dd", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 5.6.40-p3+tuxcare of laravel/framework." } } ], "dependencies": [ { "ref": "pkg:composer/laravel/framework@5.6.40-p3+tuxcare" } ] }