{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:7fe87027-1621-511a-bf67-da104095fb76",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "http-foundation",
      "purl": "pkg:composer/symfony/http-foundation@v5.4.50-p1+tuxcare",
      "type": "library",
      "group": "symfony",
      "bom-ref": "pkg:composer/symfony/http-foundation@v5.4.50-p1+tuxcare",
      "version": "v5.4.50-p1+tuxcare",
      "pedigree": {
        "ancestors": [
          {
            "name": "http-foundation",
            "purl": "pkg:composer/symfony/http-foundation@v5.4.50",
            "type": "library",
            "group": "symfony",
            "version": "v5.4.50"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2024-50345",
      "affects": [
        {
          "ref": "pkg:composer/symfony/http-foundation@v5.4.50-p1+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:36c29477-cb9a-5514-b75a-d68b39a40a84",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-50345 does not affect version v5.4.50-p1+tuxcare of symfony/http-foundation. already_fixed \u2014 The target repository (symfony/http-foundation v5.4.50) already contains the fix for CVE-2024-50345. The Request::create() method includes all four validation checks from the upstream patch that reject URIs with invalid characters, preventing parsing discrepancies between the Request class and browsers that could lead to redirect vulnerabilities.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-64500",
      "affects": [
        {
          "ref": "pkg:composer/symfony/http-foundation@v5.4.50-p1+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:8cd70ea7-3219-534e-9f98-91bae3600f7d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-64500 does not affect version v5.4.50-p1+tuxcare of symfony/http-foundation. already_fixed \u2014 The target repository (symfony/http-foundation v5.4.50) already contains the fix for CVE-2025-64500. The vulnerable code pattern described in the CVE - where the Request class could produce URL paths without a leading '/' character - has been addressed by the same fix present in the vendor patches.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-108082",
      "affects": [
        {
          "ref": "pkg:composer/symfony/http-foundation@v5.4.50-p1+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:f2a99058-3e6c-58a5-a5e5-4aa5818868d5",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-108082 is fixed in version v5.4.50-p1+tuxcare of symfony/http-foundation."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:composer/symfony/http-foundation@v5.4.50-p1+tuxcare"
    }
  ]
}