{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:e515e2b4-e92b-5fdb-ac28-d4af2c088c7a",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "http-foundation",
      "purl": "pkg:composer/symfony/http-foundation@v6.4.35-p1+tuxcare",
      "type": "library",
      "group": "symfony",
      "bom-ref": "pkg:composer/symfony/http-foundation@v6.4.35-p1+tuxcare",
      "version": "v6.4.35-p1+tuxcare",
      "pedigree": {
        "ancestors": [
          {
            "name": "http-foundation",
            "purl": "pkg:composer/symfony/http-foundation@v6.4.35",
            "type": "library",
            "group": "symfony",
            "version": "v6.4.35"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-14773",
      "affects": [
        {
          "ref": "pkg:composer/symfony/http-foundation@v6.4.35-p1+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:7c9a508a-1d6c-55cd-96b1-c2ed589b7385",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-14773 does not affect version v6.4.35-p1+tuxcare of symfony/http-foundation. not_affected \u2014 The target repository (Symfony HttpFoundation v6.4.35-p1+tuxcare) is not affected by CVE-2018-14773. The vulnerability involved legacy IIS headers (X-Original-URL and X-Rewrite-URL) that could override the request URI without verification. The fix, which removed support for these headers, was applied by upstream Symfony in version 4.1.3 (July 2018). Version 6.4.35, released in 2024 and onboarde...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2019-10913",
      "affects": [
        {
          "ref": "pkg:composer/symfony/http-foundation@v6.4.35-p1+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:d8fee37a-aac6-5190-a754-185f1ca826ba",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2019-10913 affects version v6.4.35-p1+tuxcare of symfony/http-foundation."
      }
    },
    {
      "id": "CVE-2019-18888",
      "affects": [
        {
          "ref": "pkg:composer/symfony/http-foundation@v6.4.35-p1+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:2f04fb85-6d17-5122-9f04-91ccc44a973a",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2019-18888 affects version v6.4.35-p1+tuxcare of symfony/http-foundation."
      }
    },
    {
      "id": "CVE-2024-50345",
      "affects": [
        {
          "ref": "pkg:composer/symfony/http-foundation@v6.4.35-p1+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:da42308c-9b04-5256-81c4-6a81040059a1",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-50345 does not affect version v6.4.35-p1+tuxcare of symfony/http-foundation. already_fixed \u2014 The target repository (symfony/http-foundation v6.4.35) already contains the complete fix for CVE-2024-50345. The URI validation checks added by the upstream patch are present at lines 369-377 of Request.php, preventing URIs with special characters from being parsed differently than browsers.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-64500",
      "affects": [
        {
          "ref": "pkg:composer/symfony/http-foundation@v6.4.35-p1+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:d88496af-6bfa-50f7-938c-cd9a40558ad9",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-64500 does not affect version v6.4.35-p1+tuxcare of symfony/http-foundation. already_fixed \u2014 The target repository (Symfony HttpFoundation v6.4.35) already contains the fix for CVE-2025-64500. The defense code at Request.php:1944-1945 ensures that all URL paths start with '/', preventing the vulnerability where crafted PATH_INFO could result in paths not starting with '/' and bypassing access control rules.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-108082",
      "affects": [
        {
          "ref": "pkg:composer/symfony/http-foundation@v6.4.35-p1+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:09e14e26-64f5-5854-8c00-193dc33d4499",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-108082 is fixed in version v6.4.35-p1+tuxcare of symfony/http-foundation."
      }
    },
    {
      "id": "CVE-2026-48736",
      "affects": [
        {
          "ref": "pkg:composer/symfony/http-foundation@v6.4.35-p1+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:53f4d777-6f78-5bab-a8e9-c0c92cf2ebf7",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-48736 does not affect version v6.4.35-p1+tuxcare of symfony/http-foundation. not_affected \u2014 CVE-2026-48736 affects IpUtils::PRIVATE_SUBNETS, which omits IPv6 transition prefixes (6to4, NAT64, Teredo, IPv4-compatible). The incomplete constant exists in this repository (IpUtils.php lines 21-34), missing 5 critical ranges that the upstream fix (commit 3ebc78a9, not in HEAD) adds. However, symfony/http-foundation is a library that only EXPORTS isPrivateIp() and PRIVATE_SUBNETS\u2014its own pro...",
        "justification": "code_not_reachable"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:composer/symfony/http-foundation@v6.4.35-p1+tuxcare"
    }
  ]
}