{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:125288e2-1774-54e5-9b42-0f8aaa84e2ca",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "micrometer-core",
      "purl": "pkg:maven/io.micrometer/micrometer-core@1.12.13-tuxcare.1",
      "type": "library",
      "group": "io.micrometer",
      "bom-ref": "pkg:maven/io.micrometer/micrometer-core@1.12.13-tuxcare.1",
      "version": "1.12.13-tuxcare.1",
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-40983",
      "affects": [
        {
          "ref": "pkg:maven/io.micrometer/micrometer-core@1.12.13-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:9c13829c-aed9-59aa-b620-a264a88d96d1",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-40983 does not affect version 1.12.13-tuxcare.1 of io.micrometer:micrometer-core. Target version 1.12.13 is NOT AFFECTED by CVE-2026-40983. The vulnerable code pattern (using attacker-controlled peer name/port in low-cardinality metric tags) does not exist in this version. The vulnerability was introduced in upstream v1.15.0 when peer information fields were added to GrpcServerObservationContext and used in low-cardinality tags, enabling metric cardinality explosion attacks. Version 1.12.13 predates this change\u2014its observation context lacks peerName and peerPort fields entirely, and the convention class never attempts to use peer information.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-40984",
      "affects": [
        {
          "ref": "pkg:maven/io.micrometer/micrometer-core@1.12.13-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:6a56222b-2957-5e85-87a4-9d65377b1332",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-40984 is fixed in version 1.12.13-tuxcare.1 of io.micrometer:micrometer-core."
      }
    },
    {
      "id": "CVE-2026-59295",
      "affects": [
        {
          "ref": "pkg:maven/io.micrometer/micrometer-core@1.12.13-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:99bcd754-9b15-55d6-9f76-a65ed8157783",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59295 is fixed in version 1.12.13-tuxcare.1 of io.micrometer:micrometer-core."
      }
    },
    {
      "id": "CVE-2026-59296",
      "affects": [
        {
          "ref": "pkg:maven/io.micrometer/micrometer-core@1.12.13-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:6e165ad8-d596-5cb2-b3c2-8c2ce0676d32",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59296 is fixed in version 1.12.13-tuxcare.1 of io.micrometer:micrometer-core."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/io.micrometer/micrometer-core@1.12.13-tuxcare.1"
    }
  ]
}