{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:f1898db4-afca-5281-b7b2-0b75030ca43f",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "http-foundation",
      "purl": "pkg:composer/symfony/http-foundation@v5.4.50-p1+tuxcare",
      "type": "library",
      "group": "symfony",
      "bom-ref": "pkg:composer/symfony/http-foundation@v5.4.50-p1+tuxcare",
      "version": "v5.4.50-p1+tuxcare",
      "pedigree": {
        "ancestors": [
          {
            "name": "http-foundation",
            "purl": "pkg:composer/symfony/http-foundation@v5.4.50",
            "type": "library",
            "group": "symfony",
            "version": "v5.4.50"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-14773",
      "affects": [
        {
          "ref": "pkg:composer/symfony/http-foundation@v5.4.50-p1+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:603740ec-7a51-59a9-9d5e-61f411b7931e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-14773 does not affect version v5.4.50-p1+tuxcare of symfony/http-foundation. not_affected \u2014 CVE-2018-14773 is NOT present in symfony/http-foundation v5.4.50. The vulnerability involved unsafe processing of X-Original-URL and X-Rewrite-URL headers in prepareRequestUri() that allowed attackers to override the request URI for cache poisoning attacks. The fix (complete removal of these header checks) was applied by upstream Symfony in July 2018 across all supported versions. The target v5...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2019-10913",
      "affects": [
        {
          "ref": "pkg:composer/symfony/http-foundation@v5.4.50-p1+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:5e0dab6c-430a-5f33-8a4e-11d161dd2227",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2019-10913 affects version v5.4.50-p1+tuxcare of symfony/http-foundation."
      }
    },
    {
      "id": "CVE-2019-18888",
      "affects": [
        {
          "ref": "pkg:composer/symfony/http-foundation@v5.4.50-p1+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:7fa13b26-2230-508e-9376-4b7c778945d0",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2019-18888 affects version v5.4.50-p1+tuxcare of symfony/http-foundation."
      }
    },
    {
      "id": "CVE-2024-50345",
      "affects": [
        {
          "ref": "pkg:composer/symfony/http-foundation@v5.4.50-p1+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:36c29477-cb9a-5514-b75a-d68b39a40a84",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-50345 does not affect version v5.4.50-p1+tuxcare of symfony/http-foundation. already_fixed \u2014 The target repository (symfony/http-foundation v5.4.50) already contains the fix for CVE-2024-50345. The Request::create() method includes all four validation checks from the upstream patch that reject URIs with invalid characters, preventing parsing discrepancies between the Request class and browsers that could lead to redirect vulnerabilities.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-64500",
      "affects": [
        {
          "ref": "pkg:composer/symfony/http-foundation@v5.4.50-p1+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:8cd70ea7-3219-534e-9f98-91bae3600f7d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-64500 does not affect version v5.4.50-p1+tuxcare of symfony/http-foundation. already_fixed \u2014 The target repository (symfony/http-foundation v5.4.50) already contains the fix for CVE-2025-64500. The vulnerable code pattern described in the CVE - where the Request class could produce URL paths without a leading '/' character - has been addressed by the same fix present in the vendor patches.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-108082",
      "affects": [
        {
          "ref": "pkg:composer/symfony/http-foundation@v5.4.50-p1+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:f2a99058-3e6c-58a5-a5e5-4aa5818868d5",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-108082 is fixed in version v5.4.50-p1+tuxcare of symfony/http-foundation."
      }
    },
    {
      "id": "CVE-2026-48736",
      "affects": [
        {
          "ref": "pkg:composer/symfony/http-foundation@v5.4.50-p1+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:cf5944a4-e447-51a1-a221-d7bff50053b5",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-48736 does not affect version v5.4.50-p1+tuxcare of symfony/http-foundation. not_affected \u2014 symfony/http-foundation v5.4.50 is not affected by CVE-2026-48736. On version 5.4, the vulnerable PRIVATE_SUBNETS constant (missing IPv6 transition mechanism prefixes) resides in symfony/http-client's NoPrivateNetworkHttpClient class, not in http-foundation. The http-foundation package on v5.4 only provides generic IP checking utilities (IpUtils::checkIp, checkIp4, checkIp6) and does not mainta...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:composer/symfony/http-foundation@v5.4.50-p1+tuxcare"
    }
  ]
}