{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:b117545f-283b-564a-91fe-b70a18ba35b3",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:maven/org.apache.thrift/libfb303@0.9.3-tuxcare.2",
      "type": "library",
      "group": "org.apache.thrift",
      "name": "libfb303",
      "version": "0.9.3-tuxcare.2",
      "purl": "pkg:maven/org.apache.thrift/libfb303@0.9.3-tuxcare.2"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:adc7a3f3-737b-57c6-9cd1-69f0fe82363a",
      "id": "CVE-2016-5397",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2016-5397 is fixed in version 0.9.3-tuxcare.2 of org.apache.thrift:libfb303."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.thrift/libfb303@0.9.3-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:a7dddce1-d136-5cd2-b9f7-cef16af87128",
      "id": "CVE-2018-11798",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2018-11798 is fixed in version 0.9.3-tuxcare.2 of org.apache.thrift:libfb303."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.thrift/libfb303@0.9.3-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:bbce88bd-4e93-54ea-82fc-a74758826f29",
      "id": "CVE-2018-1320",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2018-1320 is fixed in version 0.9.3-tuxcare.2 of org.apache.thrift:libfb303."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.thrift/libfb303@0.9.3-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:52340a62-0469-506f-b047-1aa3c1d162c9",
      "id": "CVE-2019-0205",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2019-0205 is fixed in version 0.9.3-tuxcare.2 of org.apache.thrift:libfb303."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.thrift/libfb303@0.9.3-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d751b6d9-fdc3-553b-a365-1a55323192af",
      "id": "CVE-2019-0210",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2019-0210 affects version 0.9.3-tuxcare.2 of org.apache.thrift:libfb303."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.thrift/libfb303@0.9.3-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:ad0966e6-b35a-5fa6-87fb-e38ebd8ed0b1",
      "id": "CVE-2019-11938",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2019-11938 affects version 0.9.3-tuxcare.2 of org.apache.thrift:libfb303."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.thrift/libfb303@0.9.3-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:f49d8cbd-a509-5119-a97f-362e27dea1dc",
      "id": "CVE-2019-11939",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2019-11939 affects version 0.9.3-tuxcare.2 of org.apache.thrift:libfb303."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.thrift/libfb303@0.9.3-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:387754ef-9a28-5c74-af4a-a938180b9966",
      "id": "CVE-2019-3552",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2019-3552 affects version 0.9.3-tuxcare.2 of org.apache.thrift:libfb303."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.thrift/libfb303@0.9.3-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d2b84920-e00e-5e93-bf74-e477c6152349",
      "id": "CVE-2019-3553",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2019-3553 affects version 0.9.3-tuxcare.2 of org.apache.thrift:libfb303."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.thrift/libfb303@0.9.3-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:41686856-b4f6-57d9-bbf5-934a839c07f3",
      "id": "CVE-2019-3558",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2019-3558 affects version 0.9.3-tuxcare.2 of org.apache.thrift:libfb303."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.thrift/libfb303@0.9.3-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d47cdf4e-0bef-57ba-8af1-31f0e329b069",
      "id": "CVE-2019-3559",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2019-3559 affects version 0.9.3-tuxcare.2 of org.apache.thrift:libfb303."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.thrift/libfb303@0.9.3-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:679c3822-9aeb-50d1-92fe-a6daa42e1be8",
      "id": "CVE-2019-3564",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2019-3564 affects version 0.9.3-tuxcare.2 of org.apache.thrift:libfb303."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.thrift/libfb303@0.9.3-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:7ba70843-1e86-52fe-9b1a-024b0dc8d49b",
      "id": "CVE-2019-3565",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2019-3565 affects version 0.9.3-tuxcare.2 of org.apache.thrift:libfb303."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.thrift/libfb303@0.9.3-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:351c2849-eebf-5e2b-9226-d57a6285bdd3",
      "id": "CVE-2020-13949",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2020-13949 is fixed in version 0.9.3-tuxcare.2 of org.apache.thrift:libfb303."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.thrift/libfb303@0.9.3-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:18a2a5f4-2297-57c6-be1a-53a0b7d93e92",
      "id": "CVE-2021-24028",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2021-24028 is a false positive for org.apache.thrift:libfb303 0.9.3-tuxcare.2. CVE-2021-24028 is a false positive for this repository. The vulnerability affects Facebook Thrift (fbthrift), a separate fork maintained by Meta at github.com/facebook/fbthrift with features like table-based serialization. This repository is Apache Thrift 0.9.3, the original Apache Software Foundation project, which does not contain Facebook Thrift code, has no vendored copy of it, and declares no dependency on it. The two projects diverged significantly, and Facebook Thrift's table-based serialization feature does not exist in Apache Thrift."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.thrift/libfb303@0.9.3-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:bad85e69-bef9-5cee-a6a8-81ba6793bc36",
      "id": "CVE-2026-43869",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-43869 affects version 0.9.3-tuxcare.2 of org.apache.thrift:libfb303."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.thrift/libfb303@0.9.3-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:a1b9bb90-3182-5842-b1e2-8246b532177b",
      "id": "CVE-2026-43871",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-43871 affects version 0.9.3-tuxcare.2 of org.apache.thrift:libfb303."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.thrift/libfb303@0.9.3-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:c25d16c8-883f-5b39-849b-09b22b57e72a",
      "id": "CVE-2026-48586",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-48586 affects version 0.9.3-tuxcare.2 of org.apache.thrift:libfb303."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.thrift/libfb303@0.9.3-tuxcare.2"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.thrift/libfb303@0.9.3-tuxcare.2"
    }
  ]
}