{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:fe6544d5-b127-56c4-bfb0-722c9a8a9e47",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:maven/org.jboss.xnio/xnio-nio@3.8.0.Final-tuxcare.1",
      "type": "library",
      "group": "org.jboss.xnio",
      "name": "xnio-nio",
      "version": "3.8.0.Final-tuxcare.1",
      "purl": "pkg:maven/org.jboss.xnio/xnio-nio@3.8.0.Final-tuxcare.1"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:22bdb4ef-7c9b-5aa4-a820-45ab9b006a07",
      "id": "CVE-2020-14340",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2020-14340 affects version 3.8.0.Final-tuxcare.1 of org.jboss.xnio:xnio-nio."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.jboss.xnio/xnio-nio@3.8.0.Final-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:261795ff-9a10-5477-ab41-640a5d40e136",
      "id": "CVE-2022-0084",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-0084 does not affect version 3.8.0.Final-tuxcare.1 of org.jboss.xnio:xnio-nio. Version 3.8.0.Final is NOT affected by CVE-2022-0084. The vulnerable code pattern (notifyReadClosed/notifyWriteClosed methods with printStackTrace or ERROR-level logging in StreamConnection.java) was introduced AFTER this version by commit XNIO-392 (7d0237c6), which was merged between versions 3.8.5 and 3.8.7. The target version 3.8.0.Final predates both the vulnerability introduction and the subsequent fix in 3.8.8.Final. Analysis of the target code confirms no excessive logging pattern exists in any connection close handlers."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.jboss.xnio/xnio-nio@3.8.0.Final-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:26a59154-c172-5b06-94fd-479439129965",
      "id": "CVE-2023-5685",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2023-5685 is fixed in version 3.8.0.Final-tuxcare.1 of org.jboss.xnio:xnio-nio."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.jboss.xnio/xnio-nio@3.8.0.Final-tuxcare.1"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.jboss.xnio/xnio-nio@3.8.0.Final-tuxcare.1"
    }
  ]
}