{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:a6ac6252-6270-5676-b472-81fcebb24aca",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "micrometer-core",
      "purl": "pkg:maven/io.micrometer/micrometer-core@1.12.6-tuxcare.1",
      "type": "library",
      "group": "io.micrometer",
      "bom-ref": "pkg:maven/io.micrometer/micrometer-core@1.12.6-tuxcare.1",
      "version": "1.12.6-tuxcare.1",
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-40983",
      "affects": [
        {
          "ref": "pkg:maven/io.micrometer/micrometer-core@1.12.6-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:2e1ca4ec-418d-59c4-b5e5-091f8eaf8c48",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-40983 does not affect version 1.12.6-tuxcare.1 of io.micrometer:micrometer-core. CVE-2026-40983 is caused by DefaultGrpcServerObservationConvention emitting the client peer address (PEER_NAME/PEER_PORT) as low-cardinality key values, which DefaultMeterObservationHandler turns into unbounded metric time series. The upstream fix dc2e5e2e moves them to high-cardinality, and the peer tags were only introduced in 1.15.0. In tuxcare-current/1.12.6 (ded232c4) the server convention emits only method, service, method type and status code. GrpcObservationDocumentation defines no PEER_NAME/PEER_PORT keys, GrpcServerObservationContext has no peer fields, and the file is unchanged since upstream commit 036b40e4. The vulnerable code is not present, consistent with the advisory (\u201colder versions than 1.15.0 are not affected\u201d) and with siblings 1.12.12 and 1.12.13 (not_affected/code_not_present).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-40984",
      "affects": [
        {
          "ref": "pkg:maven/io.micrometer/micrometer-core@1.12.6-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:49bb2148-7f47-5d1f-a7ac-cd296f5c6d8b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-40984 affects version 1.12.6-tuxcare.1 of io.micrometer:micrometer-core."
      }
    },
    {
      "id": "CVE-2026-59295",
      "affects": [
        {
          "ref": "pkg:maven/io.micrometer/micrometer-core@1.12.6-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:e6da8121-be10-548a-980e-72ca137357ed",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-59295 does not affect version 1.12.6-tuxcare.1 of io.micrometer:micrometer-core. not_affected \u2014 CVE-2026-59295 describes a memory leak vulnerability in MicrometerHttpClientInterceptor classes when async HTTP requests fail before receiving responses. The vulnerable code pattern IS present in micrometer-core 1.12.6 (both HC4 and HC5 interceptor classes lack error handling for pre-response failures). However, micrometer-core is a library that only exports these classes as part of its public ...",
        "justification": "code_not_reachable"
      }
    },
    {
      "id": "CVE-2026-59296",
      "affects": [
        {
          "ref": "pkg:maven/io.micrometer/micrometer-core@1.12.6-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:695d5a47-ac4c-56e8-90d9-f60b9a51e0e6",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-59296 affects version 1.12.6-tuxcare.1 of io.micrometer:micrometer-core."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/io.micrometer/micrometer-core@1.12.6-tuxcare.1"
    }
  ]
}