{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:b5127c4d-8e26-571f-b6b9-bf24e5f3f4f5",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "micrometer-core",
      "purl": "pkg:maven/io.micrometer/micrometer-core@1.6.5-tuxcare.1",
      "type": "library",
      "group": "io.micrometer",
      "bom-ref": "pkg:maven/io.micrometer/micrometer-core@1.6.5-tuxcare.1",
      "version": "1.6.5-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "micrometer-core",
            "purl": "pkg:maven/io.micrometer/micrometer-core@1.6.5",
            "type": "library",
            "group": "io.micrometer",
            "version": "1.6.5"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-40983",
      "affects": [
        {
          "ref": "pkg:maven/io.micrometer/micrometer-core@1.6.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:0523bf69-a289-5dae-85ae-acaf056889fe",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-40983 does not affect version 1.6.5-tuxcare.1 of io.micrometer:micrometer-core. Micrometer version 1.6.5 is NOT affected by CVE-2026-40983. The vulnerability requires the Observation API and gRPC observation support (specifically ObservationGrpcServerInterceptor and DefaultGrpcServerObservationConvention), which do not exist in version 1.6.5. The Observation API was introduced in February 2022 (around version 1.10.x), and gRPC observation support came later in version 1.15.x. The CVE explicitly states \"Older versions than 1.15.0 are not affected.\" This is Type A1 (input not processed): the vulnerable code path involving gRPC server observation handling does not exist in this version.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-40984",
      "affects": [
        {
          "ref": "pkg:maven/io.micrometer/micrometer-core@1.6.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:8f4b6723-1320-5412-92a1-8f69904e0838",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-40984 affects version 1.6.5-tuxcare.1 of io.micrometer:micrometer-core."
      }
    },
    {
      "id": "CVE-2026-59295",
      "affects": [
        {
          "ref": "pkg:maven/io.micrometer/micrometer-core@1.6.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:03f9d291-e0c6-516e-a7c4-a83c5a7c9aff",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-59295 affects version 1.6.5-tuxcare.1 of io.micrometer:micrometer-core."
      }
    },
    {
      "id": "CVE-2026-59296",
      "affects": [
        {
          "ref": "pkg:maven/io.micrometer/micrometer-core@1.6.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:ee1079f6-b889-52d8-81d0-9ba06bd9dd8e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-59296 affects version 1.6.5-tuxcare.1 of io.micrometer:micrometer-core."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/io.micrometer/micrometer-core@1.6.5-tuxcare.1"
    }
  ]
}