{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:259eff2a-b302-5582-a191-dc3334f00655",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "http-foundation",
      "purl": "pkg:composer/symfony/http-foundation@v7.4.8-p1+tuxcare",
      "type": "library",
      "group": "symfony",
      "bom-ref": "pkg:composer/symfony/http-foundation@v7.4.8-p1+tuxcare",
      "version": "v7.4.8-p1+tuxcare",
      "pedigree": {
        "ancestors": [
          {
            "name": "http-foundation",
            "purl": "pkg:composer/symfony/http-foundation@v7.4.8",
            "type": "library",
            "group": "symfony",
            "version": "v7.4.8"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-14773",
      "affects": [
        {
          "ref": "pkg:composer/symfony/http-foundation@v7.4.8-p1+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:569cb369-84d6-57fd-a1eb-0941ee936759",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-14773 does not affect version v7.4.8-p1+tuxcare of symfony/http-foundation. not_affected \u2014 CVE-2018-14773 is not present in symfony/http-foundation v7.4.8-p1+tuxcare. The vulnerable code pattern that trusted X-Original-URL and X-Rewrite-URL headers was removed by upstream Symfony in 2018. The fix (authored by Nicolas Grekas) was already included in the upstream Symfony v7.4.8 release that TuxCare onboarded. The target's prepareRequestUri() method does not check for these headers, pre...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2019-10913",
      "affects": [
        {
          "ref": "pkg:composer/symfony/http-foundation@v7.4.8-p1+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:fc528bab-d250-5429-805e-39d30ebda54b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2019-10913 affects version v7.4.8-p1+tuxcare of symfony/http-foundation."
      }
    },
    {
      "id": "CVE-2019-18888",
      "affects": [
        {
          "ref": "pkg:composer/symfony/http-foundation@v7.4.8-p1+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:46acc46c-ddd6-5d6b-ac62-ac50b86c5af9",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2019-18888 affects version v7.4.8-p1+tuxcare of symfony/http-foundation."
      }
    },
    {
      "id": "CVE-2024-50345",
      "affects": [
        {
          "ref": "pkg:composer/symfony/http-foundation@v7.4.8-p1+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:f7626bc5-0f9e-591d-9e18-332cc7b2b897",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-50345 does not affect version v7.4.8-p1+tuxcare of symfony/http-foundation. already_fixed \u2014 The target repository (symfony/http-foundation v7.4.8) already contains the fix for CVE-2024-50345. All four validation checks from the vendor patch are present in Request::create() at lines 354-374, rejecting URIs with invalid characters that could cause parsing discrepancies between PHP and browsers.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-64500",
      "affects": [
        {
          "ref": "pkg:composer/symfony/http-foundation@v7.4.8-p1+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:0eb89360-e27c-506c-930f-c0753449beb8",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-64500 does not affect version v7.4.8-p1+tuxcare of symfony/http-foundation. already_fixed \u2014 CVE-2025-64500: The target repository (symfony/http-foundation v7.4.8) already contains the fix for the PATH_INFO leading slash vulnerability. The preparePathInfo() method at Request.php:2038-2039 includes the critical check that ensures all path values start with '/' by detecting when pathInfo[0] is not '/' and prepending a slash. This is the same defense mechanism as the upstream patch.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-108082",
      "affects": [
        {
          "ref": "pkg:composer/symfony/http-foundation@v7.4.8-p1+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:81fa95e6-b0b8-55cf-843e-a6c346331f35",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-108082 is fixed in version v7.4.8-p1+tuxcare of symfony/http-foundation."
      }
    },
    {
      "id": "CVE-2026-48736",
      "affects": [
        {
          "ref": "pkg:composer/symfony/http-foundation@v7.4.8-p1+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:db17e3fa-8e4e-5b9b-9bed-1f32a88591fa",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-48736 does not affect version v7.4.8-p1+tuxcare of symfony/http-foundation. not_affected \u2014 The target repository (symfony/http-foundation v7.4.8) is a library that exports IpUtils::isPrivateIp() and PRIVATE_SUBNETS, which do contain the vulnerability pattern described in CVE-2026-48736 (incomplete IPv6 transition prefix coverage). However, the library itself does not execute any code path that processes user-supplied URLs or makes HTTP requests to private networks. The vulnerable cod...",
        "justification": "code_not_reachable"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:composer/symfony/http-foundation@v7.4.8-p1+tuxcare"
    }
  ]
}