{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:61d12273-3281-577b-b7d2-98581adc8553",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:maven/io.micronaut/micronaut-http-validation@3.6.0-tuxcare.1",
      "type": "library",
      "group": "io.micronaut",
      "name": "micronaut-http-validation",
      "version": "3.6.0-tuxcare.1",
      "purl": "pkg:maven/io.micronaut/micronaut-http-validation@3.6.0-tuxcare.1"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:dcdc92fe-80cb-513c-9cf7-037b8a782284",
      "id": "CVE-2024-23639",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-23639 affects version 3.6.0-tuxcare.1 of io.micronaut:micronaut-http-validation."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.micronaut/micronaut-http-validation@3.6.0-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:381ec2fc-fe34-57f5-8e97-dcdcb123bd5b",
      "id": "CVE-2025-67030",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-67030 is fixed in version 3.6.0-tuxcare.1 of io.micronaut:micronaut-http-validation."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.micronaut/micronaut-http-validation@3.6.0-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:962fb71c-a985-5e22-ab4f-0603952ef187",
      "id": "CVE-2026-33013",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-33013 affects version 3.6.0-tuxcare.1 of io.micronaut:micronaut-http-validation."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.micronaut/micronaut-http-validation@3.6.0-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:3ebac387-63b4-5ab3-8b48-065ec38fc1b7",
      "id": "CVE-2026-44241",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-44241 does not affect version 3.6.0-tuxcare.1 of io.micronaut:micronaut-http-validation. Version 3.6.0 is not affected by CVE-2026-44241. The vulnerable code pattern (unbounded formattersCache in TimeConverterRegistrar) does not exist in this version. The cache was introduced in version 4.10.0 (commit 5a58586e13, December 2023), and version 3.6.0 predates this introduction by approximately 18 months. Version 3.6.0 uses a simple resolveFormatter() method that creates DateTimeFormatter instances on-demand without any caching mechanism, which does not lead to unbounded memory consumption from varied Accept-Language headers."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.micronaut/micronaut-http-validation@3.6.0-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:a5771b35-6155-57fd-9d2f-1fbd88a025c6",
      "id": "CVE-2026-44242",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-44242 affects version 3.6.0-tuxcare.1 of io.micronaut:micronaut-http-validation."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.micronaut/micronaut-http-validation@3.6.0-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:fd2ac982-ea49-5e95-80b0-e4a3e138bee0",
      "id": "GHSA-387m-935m-c4vw",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-387m-935m-c4vw affects version 3.6.0-tuxcare.1 of io.micronaut:micronaut-http-validation."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.micronaut/micronaut-http-validation@3.6.0-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:2758eaee-dcd4-53b3-9c79-718c54c1ef41",
      "id": "GHSA-q6gh-6v2r-hjv3",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-q6gh-6v2r-hjv3 affects version 3.6.0-tuxcare.1 of io.micronaut:micronaut-http-validation."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.micronaut/micronaut-http-validation@3.6.0-tuxcare.1"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/io.micronaut/micronaut-http-validation@3.6.0-tuxcare.1"
    }
  ]
}