{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:392e0081-154d-5968-aa4b-8ec90eeb1d68",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:maven/io.micronaut/micronaut-aop@3.8.5-tuxcare.2",
      "type": "library",
      "group": "io.micronaut",
      "name": "micronaut-aop",
      "version": "3.8.5-tuxcare.2",
      "purl": "pkg:maven/io.micronaut/micronaut-aop@3.8.5-tuxcare.2"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:4b4ea6d7-47c3-5fd2-bd29-c2e8c750c90c",
      "id": "CVE-2026-33013",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-33013 is fixed in version 3.8.5-tuxcare.2 of io.micronaut:micronaut-aop."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.micronaut/micronaut-aop@3.8.5-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:ed0b5e2a-9fcf-5b1a-9b1e-d65ee152f5e4",
      "id": "CVE-2026-44241",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-44241 does not affect version 3.8.5-tuxcare.2 of io.micronaut:micronaut-aop. Version 3.8.5 is not vulnerable to CVE-2026-44241. The unbounded formattersCache described in the CVE does not exist in this version. The vulnerable caching mechanism was added in commit 5a58586e13 (December 2023) and first released in v4.3.0, which is 1187 commits AFTER v3.8.5. The target version creates DateTimeFormatter instances on-the-fly without caching (line 190, 223), making unbounded cache growth impossible."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.micronaut/micronaut-aop@3.8.5-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:1ebb4262-ca7f-595a-9774-0832162d0386",
      "id": "CVE-2026-44242",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-44242 is fixed in version 3.8.5-tuxcare.2 of io.micronaut:micronaut-aop."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.micronaut/micronaut-aop@3.8.5-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:39b302de-83d2-5b11-b4ad-e2da771a032f",
      "id": "GHSA-387m-935m-c4vw",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-387m-935m-c4vw is fixed in version 3.8.5-tuxcare.2 of io.micronaut:micronaut-aop."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.micronaut/micronaut-aop@3.8.5-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:a86d7046-b18f-5f20-acdb-379bf641e7cd",
      "id": "GHSA-q6gh-6v2r-hjv3",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-q6gh-6v2r-hjv3 is fixed in version 3.8.5-tuxcare.2 of io.micronaut:micronaut-aop."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.micronaut/micronaut-aop@3.8.5-tuxcare.2"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/io.micronaut/micronaut-aop@3.8.5-tuxcare.2"
    }
  ]
}