{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:cfaa08af-ee17-5757-bd80-d4f44b024e9a",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "requests",
      "purl": "pkg:pypi/requests@2.31.0.post3+tuxcare",
      "type": "library",
      "bom-ref": "pkg:pypi/requests@2.31.0.post3+tuxcare",
      "version": "2.31.0.post3+tuxcare",
      "pedigree": {
        "ancestors": [
          {
            "name": "requests",
            "purl": "pkg:pypi/requests@2.31.0",
            "type": "library",
            "version": "2.31.0"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2023-32681",
      "affects": [
        {
          "ref": "pkg:pypi/requests@2.31.0.post3+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:cd819ef4-7543-5a13-848b-c5da608cb5bf",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-32681 does not affect version 2.31.0.post3+tuxcare of requests. not_affected \u2014 The target (requests 2.31.0.post3+tuxcare) is NOT AFFECTED by CVE-2023-32681. The vulnerability pattern that leaked Proxy-Authorization headers to HTTPS destination servers is not present in the target code. The fix was shipped in the upstream requests v2.31.0 release (commit 74ea7cf7) authored by Nate Prewitt, which predates all TuxCare modifications to this version branch. The fix prevents ad...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-35195",
      "affects": [
        {
          "ref": "pkg:pypi/requests@2.31.0.post3+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:41e6b627-29c8-5d14-a3cc-dac9eee1f3cf",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-35195 is fixed in version 2.31.0.post3+tuxcare of requests."
      }
    },
    {
      "id": "CVE-2024-47081",
      "affects": [
        {
          "ref": "pkg:pypi/requests@2.31.0.post3+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:37b8be44-826a-5b19-892f-8d171a1fcdcf",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-47081 is fixed in version 2.31.0.post3+tuxcare of requests."
      }
    },
    {
      "id": "CVE-2026-25645",
      "affects": [
        {
          "ref": "pkg:pypi/requests@2.31.0.post3+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:5fc4ceaf-3b9a-5383-943d-4de549896b3a",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-25645 is fixed in version 2.31.0.post3+tuxcare of requests."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:pypi/requests@2.31.0.post3+tuxcare"
    }
  ]
}