{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:7f38f6a5-1a5c-5b02-aaf2-98db5d1631c6",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:maven/io.micronaut/micronaut-jackson-databind@3.10.4-tuxcare.1",
      "type": "library",
      "group": "io.micronaut",
      "name": "micronaut-jackson-databind",
      "version": "3.10.4-tuxcare.1",
      "purl": "pkg:maven/io.micronaut/micronaut-jackson-databind@3.10.4-tuxcare.1"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:5334c914-9398-5b85-9324-f914d17520aa",
      "id": "CVE-2026-33013",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-33013 is fixed in version 3.10.4-tuxcare.1 of io.micronaut:micronaut-jackson-databind."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.micronaut/micronaut-jackson-databind@3.10.4-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:69e075bf-216a-5d2f-b609-383bed016418",
      "id": "CVE-2026-44241",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-44241 does not affect version 3.10.4-tuxcare.1 of io.micronaut:micronaut-jackson-databind. Micronaut 3.10.4 is NOT AFFECTED by CVE-2026-44241. The vulnerable unbounded formattersCache field and associated caching mechanism were introduced in version 4.3.0 (commit 5a58586e13, April 2024) and do not exist in this earlier version. The target processes locale values from Accept-Language headers but creates DateTimeFormatter instances on-demand without caching (lines 198, 231), preventing unbounded memory accumulation. While the INPUT (locale tags) is received, no execution path to the GOAL (memory exhaustion via cache growth) exists because the caching mechanism is architecturally absent."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.micronaut/micronaut-jackson-databind@3.10.4-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:a679237d-19e7-5ce1-9d74-a95102c79cff",
      "id": "CVE-2026-44242",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-44242 is fixed in version 3.10.4-tuxcare.1 of io.micronaut:micronaut-jackson-databind."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.micronaut/micronaut-jackson-databind@3.10.4-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:55c9b589-24f9-5ce9-94ff-c67c120f5206",
      "id": "GHSA-387m-935m-c4vw",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-387m-935m-c4vw is fixed in version 3.10.4-tuxcare.1 of io.micronaut:micronaut-jackson-databind."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.micronaut/micronaut-jackson-databind@3.10.4-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:9ce06e0d-68df-5fa9-a295-6e1d444f513b",
      "id": "GHSA-q6gh-6v2r-hjv3",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-q6gh-6v2r-hjv3 is fixed in version 3.10.4-tuxcare.1 of io.micronaut:micronaut-jackson-databind."
      },
      "affects": [
        {
          "ref": "pkg:maven/io.micronaut/micronaut-jackson-databind@3.10.4-tuxcare.1"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/io.micronaut/micronaut-jackson-databind@3.10.4-tuxcare.1"
    }
  ]
}