{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:afd4881c-b60c-501f-9d0e-1ff44cce5d88",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "HdrHistogram",
      "purl": "pkg:maven/org.hdrhistogram/HdrHistogram@2.1.12-tuxcare.1",
      "type": "library",
      "group": "org.hdrhistogram",
      "bom-ref": "pkg:maven/org.hdrhistogram/HdrHistogram@2.1.12-tuxcare.1",
      "version": "2.1.12-tuxcare.1",
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-14683",
      "affects": [
        {
          "ref": "pkg:maven/org.hdrhistogram/HdrHistogram@2.1.12-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:52dd77ba-2c1e-5e78-acb2-acb5d86f8bd0",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-14683 is fixed in version 2.1.12-tuxcare.1 of org.hdrhistogram:HdrHistogram."
      }
    },
    {
      "id": "CVE-2026-14684",
      "affects": [
        {
          "ref": "pkg:maven/org.hdrhistogram/HdrHistogram@2.1.12-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:e6be7787-de77-52ef-a89f-cd3cac9b9dab",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-14684 does not affect version 2.1.12-tuxcare.1 of org.hdrhistogram:HdrHistogram. not_affected \u2014 CVE-2026-14684 claims uncontrolled memory allocation via numberOfSignificantValueDigits in AbstractHistogram.decodeFromByteBuffer. In 2.1.12 the decoded value is passed through the histogram constructor (AbstractHistogram.java:2132-2134), and AbstractHistogram(long,long,int) rejects values outside 0\u20135 (lines 284-286) before init() allocates the counts array. The code is identical to 2.1.8/2.1.10/2.1.11, which are already not_affected for this CVE.",
        "justification": "protected_at_runtime"
      }
    },
    {
      "id": "CVE-2026-14685",
      "affects": [
        {
          "ref": "pkg:maven/org.hdrhistogram/HdrHistogram@2.1.12-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:9eeb15db-e959-5e92-b754-7c6ab14eb9dd",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-14685 does not affect version 2.1.12-tuxcare.1 of org.hdrhistogram:HdrHistogram. not_affected \u2014 CVE-2026-14685 is DISPUTED and targets the recordValueWithCount() function in HdrHistogram 2.1.12. The function does lack input validation for the count parameter, allowing negative values or overflow conditions that can corrupt the histogram's totalCount field. However, this is a LIB target where the library exports the API but does not internally route attacker-controlled input to it. Exploit...",
        "justification": "code_not_reachable"
      }
    },
    {
      "id": "CVE-2026-14686",
      "affects": [
        {
          "ref": "pkg:maven/org.hdrhistogram/HdrHistogram@2.1.12-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:7f76526c-fc24-5489-88ce-8cbd83a3805e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-14686 does not affect version 2.1.12-tuxcare.1 of org.hdrhistogram:HdrHistogram. not_affected \u2014 CVE-2026-14686 describes an incorrect comparison in HdrHistogram's DoubleHistogram.recordValue range check (`>` instead of `>=`). Fixed upstream by Gil Tene <gil@cloud7.com> in commits a26bb1f72a8bbc14f1ec897b5a0db29efc6cb75d (May 2015) and 753fe5c16ddb089b42a6ff920c06e50ead032945 (July 2019). Both are present in the target 2.1.12 at HEAD efe0e32124c504d173699a853e15220478f8c8d9; CloudLinux authored no backport \u2014 the upstream release carrying the fixes was merged into tuxcare-current/2.1.12. Set manually after review.",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.hdrhistogram/HdrHistogram@2.1.12-tuxcare.1"
    }
  ]
}