{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:344fabb0-43b1-5e04-a440-5905ba2699c4",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "async-http-client-extras-registry",
      "purl": "pkg:maven/org.asynchttpclient/async-http-client-extras-registry@2.12.1-tuxcare.1",
      "type": "library",
      "group": "org.asynchttpclient",
      "bom-ref": "pkg:maven/org.asynchttpclient/async-http-client-extras-registry@2.12.1-tuxcare.1",
      "version": "2.12.1-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "async-http-client-extras-registry",
            "purl": "pkg:maven/org.asynchttpclient/async-http-client-extras-registry@2.12.1",
            "type": "library",
            "group": "org.asynchttpclient",
            "version": "2.12.1"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2024-53990",
      "affects": [
        {
          "ref": "pkg:maven/org.asynchttpclient/async-http-client-extras-registry@2.12.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:c23b7d6d-d758-5e85-940c-d4ec70456880",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-53990 is fixed in version 2.12.1-tuxcare.1 of org.asynchttpclient:async-http-client-extras-registry."
      }
    },
    {
      "id": "CVE-2026-107226",
      "affects": [
        {
          "ref": "pkg:maven/org.asynchttpclient/async-http-client-extras-registry@2.12.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:da16dcb2-6947-5e39-9d6c-f8616bfea0fd",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-107226 affects version 2.12.1-tuxcare.1 of org.asynchttpclient:async-http-client-extras-registry, and is fixed in 2.12.1-tuxcare.2."
      }
    },
    {
      "id": "CVE-2026-107227",
      "affects": [
        {
          "ref": "pkg:maven/org.asynchttpclient/async-http-client-extras-registry@2.12.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:67cdeb12-ab7c-53dd-8d67-ca7c16d9c3c8",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-107227 affects version 2.12.1-tuxcare.1 of org.asynchttpclient:async-http-client-extras-registry, and is fixed in 2.12.1-tuxcare.2."
      }
    },
    {
      "id": "CVE-2026-107228",
      "affects": [
        {
          "ref": "pkg:maven/org.asynchttpclient/async-http-client-extras-registry@2.12.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:d5c1a00f-82b6-5b2b-b6b4-aa1a3ce79357",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-107228 affects version 2.12.1-tuxcare.1 of org.asynchttpclient:async-http-client-extras-registry."
      }
    },
    {
      "id": "CVE-2026-107230",
      "affects": [
        {
          "ref": "pkg:maven/org.asynchttpclient/async-http-client-extras-registry@2.12.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:817f8068-a56d-5482-b07d-6d66d1647173",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-107230 affects version 2.12.1-tuxcare.1 of org.asynchttpclient:async-http-client-extras-registry, and is fixed in 2.12.1-tuxcare.2."
      }
    },
    {
      "id": "CVE-2026-107231",
      "affects": [
        {
          "ref": "pkg:maven/org.asynchttpclient/async-http-client-extras-registry@2.12.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:fc4f4da4-e17b-5274-ad63-af4517c7fb46",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-107231 is fixed in version 2.12.1-tuxcare.1 of org.asynchttpclient:async-http-client-extras-registry."
      }
    },
    {
      "id": "CVE-2026-107280",
      "affects": [
        {
          "ref": "pkg:maven/org.asynchttpclient/async-http-client-extras-registry@2.12.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:13123d52-4ecb-5781-9412-4c51a8cbdee5",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-107280 is fixed in version 2.12.1-tuxcare.1 of org.asynchttpclient:async-http-client-extras-registry."
      }
    },
    {
      "id": "CVE-2026-107282",
      "affects": [
        {
          "ref": "pkg:maven/org.asynchttpclient/async-http-client-extras-registry@2.12.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:0f1dab8c-38ca-58eb-9033-541abb899c19",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-107282 is fixed in version 2.12.1-tuxcare.1 of org.asynchttpclient:async-http-client-extras-registry."
      }
    },
    {
      "id": "CVE-2026-107283",
      "affects": [
        {
          "ref": "pkg:maven/org.asynchttpclient/async-http-client-extras-registry@2.12.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:40e59233-9fee-5908-893d-e884fe1c5a9e",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-107283 is fixed in version 2.12.1-tuxcare.1 of org.asynchttpclient:async-http-client-extras-registry."
      }
    },
    {
      "id": "CVE-2026-107285",
      "affects": [
        {
          "ref": "pkg:maven/org.asynchttpclient/async-http-client-extras-registry@2.12.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:66a9aab7-e1f7-5fa1-94dd-a16ab6d11dcb",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-107285 is fixed in version 2.12.1-tuxcare.1 of org.asynchttpclient:async-http-client-extras-registry."
      }
    },
    {
      "id": "CVE-2026-40490",
      "affects": [
        {
          "ref": "pkg:maven/org.asynchttpclient/async-http-client-extras-registry@2.12.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:94a982ef-1750-5497-aa68-604c7b3eced9",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-40490 is fixed in version 2.12.1-tuxcare.1 of org.asynchttpclient:async-http-client-extras-registry."
      }
    },
    {
      "id": "CVE-2026-45300",
      "affects": [
        {
          "ref": "pkg:maven/org.asynchttpclient/async-http-client-extras-registry@2.12.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:9f24bb8e-6632-5199-94eb-f34733f15031",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-45300 is fixed in version 2.12.1-tuxcare.1 of org.asynchttpclient:async-http-client-extras-registry."
      }
    },
    {
      "id": "CVE-2026-55688",
      "affects": [
        {
          "ref": "pkg:maven/org.asynchttpclient/async-http-client-extras-registry@2.12.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:b7d224c1-863d-5763-83ba-dd8a9355d913",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-55688 is fixed in version 2.12.1-tuxcare.1 of org.asynchttpclient:async-http-client-extras-registry."
      }
    },
    {
      "id": "CVE-2026-85716",
      "affects": [
        {
          "ref": "pkg:maven/org.asynchttpclient/async-http-client-extras-registry@2.12.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:76c2102e-8fb7-534f-a270-4614b6537ef2",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-85716 does not affect version 2.12.1-tuxcare.1 of org.asynchttpclient:async-http-client-extras-registry. not_affected \u2014 Version 2.12.1 is not affected by CVE-2026-85716. The vulnerability concerns broken mutual authentication verification in SCRAM and Digest authentication (versions 3.0.8-3.0.12), where the server's authentication tokens (ServerSignature and rspauth) were computed but only logged warnings on mismatch instead of aborting. Version 2.12.1 does not implement these mutual authentication features at a...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-85717",
      "affects": [
        {
          "ref": "pkg:maven/org.asynchttpclient/async-http-client-extras-registry@2.12.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:c9146e4d-4ed0-56eb-89ed-8d36edd0be1f",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-85717 is fixed in version 2.12.1-tuxcare.1 of org.asynchttpclient:async-http-client-extras-registry."
      }
    },
    {
      "id": "CVE-2026-85720",
      "affects": [
        {
          "ref": "pkg:maven/org.asynchttpclient/async-http-client-extras-registry@2.12.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:d9d1abcf-2ce2-5592-a91f-3b2e8c48135b",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-85720 is fixed in version 2.12.1-tuxcare.1 of org.asynchttpclient:async-http-client-extras-registry."
      }
    },
    {
      "id": "CVE-2026-85721",
      "affects": [
        {
          "ref": "pkg:maven/org.asynchttpclient/async-http-client-extras-registry@2.12.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:27b4e828-45c6-5ede-b56c-49f5471a5683",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-85721 is fixed in version 2.12.1-tuxcare.1 of org.asynchttpclient:async-http-client-extras-registry."
      }
    },
    {
      "id": "GHSA-cmxv-58fp-fm3g",
      "affects": [
        {
          "ref": "pkg:maven/org.asynchttpclient/async-http-client-extras-registry@2.12.1-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:9374fd33-dcf4-5fa2-bf3c-0275764b1ad1",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-cmxv-58fp-fm3g is fixed in version 2.12.1-tuxcare.1 of org.asynchttpclient:async-http-client-extras-registry."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.asynchttpclient/async-http-client-extras-registry@2.12.1-tuxcare.1"
    }
  ]
}