{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:8dd25c98-8044-57b5-97e7-ae0a03a495df",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "http-foundation",
      "purl": "pkg:composer/symfony/http-foundation@2.8.52-p2+tuxcare",
      "type": "library",
      "group": "symfony",
      "bom-ref": "pkg:composer/symfony/http-foundation@2.8.52-p2+tuxcare",
      "version": "2.8.52-p2+tuxcare",
      "pedigree": {
        "ancestors": [
          {
            "name": "http-foundation",
            "purl": "pkg:composer/symfony/http-foundation@2.8.52",
            "type": "library",
            "group": "symfony",
            "version": "2.8.52"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-14773",
      "affects": [
        {
          "ref": "pkg:composer/symfony/http-foundation@2.8.52-p2+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:66c0c1ab-ef13-5dc1-a4aa-3f63c5e715ad",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-14773 does not affect version 2.8.52-p2+tuxcare of symfony/http-foundation. not_affected \u2014 CVE-2018-14773 affects Symfony HttpFoundation 2.8.0-2.8.43 via untrusted X_ORIGINAL_URL and X_REWRITE_URL headers that override request URIs. The target (v2.8.52) is NOT AFFECTED\u2014the vulnerable code was removed by upstream Symfony in v2.8.44 (commit 5097611b by Nicolas Grekas). TuxCare onboarded v2.8.52 as a snapshot (commit 877d4cd2), and the fix was already present in that upstream release. N...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2019-10913",
      "affects": [
        {
          "ref": "pkg:composer/symfony/http-foundation@2.8.52-p2+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:edbc0a2a-dafb-5b68-a06a-f3b3a4dcf6f1",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2019-10913 affects version 2.8.52-p2+tuxcare of symfony/http-foundation."
      }
    },
    {
      "id": "CVE-2019-18888",
      "affects": [
        {
          "ref": "pkg:composer/symfony/http-foundation@2.8.52-p2+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:0eafcc47-4c6b-5007-befa-12322c2058af",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2019-18888 affects version 2.8.52-p2+tuxcare of symfony/http-foundation."
      }
    },
    {
      "id": "CVE-2024-50345",
      "affects": [
        {
          "ref": "pkg:composer/symfony/http-foundation@2.8.52-p2+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:43fdd356-b6a9-526c-be99-38d6ed54a01b",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-50345 is fixed in version 2.8.52-p2+tuxcare of symfony/http-foundation."
      }
    },
    {
      "id": "CVE-2025-64500",
      "affects": [
        {
          "ref": "pkg:composer/symfony/http-foundation@2.8.52-p2+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:e229c186-c122-5720-8ee3-4a48f685b4f1",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-64500 is fixed in version 2.8.52-p2+tuxcare of symfony/http-foundation."
      }
    },
    {
      "id": "CVE-2026-108082",
      "affects": [
        {
          "ref": "pkg:composer/symfony/http-foundation@2.8.52-p2+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:1b479883-cebd-5f79-afe2-785bf1776c11",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-108082 affects version 2.8.52-p2+tuxcare of symfony/http-foundation."
      }
    },
    {
      "id": "CVE-2026-48736",
      "affects": [
        {
          "ref": "pkg:composer/symfony/http-foundation@2.8.52-p2+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:5f304098-71a2-5bf3-84eb-1c6ee886684b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-48736 does not affect version 2.8.52-p2+tuxcare of symfony/http-foundation. not_affected \u2014 Version 2.8.52 of symfony/http-foundation is NOT AFFECTED by CVE-2026-48736. The vulnerability requires the PRIVATE_SUBNETS constant (introduced in 6.4+) and the isPrivateIp() method, neither of which exist in version 2.8.52. This version only provides generic IP validation utilities (checkIp, checkIp4, checkIp6) without built-in private subnet detection. The vulnerable code pattern - a pre-def...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:composer/symfony/http-foundation@2.8.52-p2+tuxcare"
    }
  ]
}