{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:de002f93-115e-5dd7-9d6b-030bd918321c",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1",
      "type": "library",
      "group": "com.fasterxml.jackson.core",
      "name": "jackson-databind",
      "version": "2.12.1-tuxcare.1",
      "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:307cb397-16f3-5769-b9df-d63aff179944",
      "id": "CVE-2020-36518",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2020-36518 is fixed in version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
      },
      "affects": [
        {
          "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:54609435-e5e0-5f98-9963-409237264e97",
      "id": "CVE-2021-46877",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2021-46877 is fixed in version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
      },
      "affects": [
        {
          "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:c2146f17-1bf6-537d-be06-a74f4713b00e",
      "id": "CVE-2022-42003",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-42003 is fixed in version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
      },
      "affects": [
        {
          "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:debb5fcb-c1e3-5624-ad9b-621664819699",
      "id": "CVE-2022-42004",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-42004 is fixed in version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
      },
      "affects": [
        {
          "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:88d10a17-f540-5235-ba5d-1a72f2f41d7a",
      "id": "CVE-2023-35116",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-35116 affects version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
      },
      "affects": [
        {
          "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:9d63b5e8-faa1-57cd-b76e-5ed125850446",
      "id": "CVE-2025-49128",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-49128 is fixed in version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
      },
      "affects": [
        {
          "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:f402dc15-caf1-53b7-9262-c6723de2e918",
      "id": "CVE-2025-52999",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-52999 is fixed in version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
      },
      "affects": [
        {
          "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:3fbbf2fd-7bf5-5c01-afb9-c3d2ff23abcc",
      "id": "CVE-2026-50193",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-50193 does not affect version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Version 2.12.1 is not vulnerable. Summary: The target repository (jackson-databind 2.12.1-tuxcare.1) is NOT VULNERABLE to CVE-2026-50193. The vulnerable code pattern described in the CVE was never present in version 2.12.1. The vulnerability was introduced during 2.14.0 development (commit d2ba1ada80 on May 3, 2022) and fixed one day later (commit a1fa4ae4ec on May 4, 2022) before the 2.14.0 release. Version 2.12.1 uses a simple, non-recursive serialization mechanism via STD_WRITER.writeValueAsString() that does not suffer from stack overflow with deeply nested JSON."
      },
      "affects": [
        {
          "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:857ce4d0-bd62-5bca-a107-58c4ddbd7bc2",
      "id": "CVE-2026-54512",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-54512 affects version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
      },
      "affects": [
        {
          "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:dc1336d4-1727-5803-964f-abfbb03ecf9e",
      "id": "CVE-2026-54513",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-54513 affects version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
      },
      "affects": [
        {
          "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:dee08db5-618b-5011-a528-3a6ef2c4f8a9",
      "id": "CVE-2026-54514",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-54514 affects version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
      },
      "affects": [
        {
          "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:f19019c0-81c8-5b7f-a453-0b0b6d0c869c",
      "id": "CVE-2026-54515",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-54515 affects version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
      },
      "affects": [
        {
          "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:29049861-5edc-5eeb-ab00-26407de73d33",
      "id": "CVE-2026-59889",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-59889 affects version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
      },
      "affects": [
        {
          "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:701c7200-e674-5902-87bd-1784e861b97a",
      "id": "GHSA-72hv-8253-57qq",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-72hv-8253-57qq is fixed in version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
      },
      "affects": [
        {
          "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:6bea8a99-28cd-5392-aa65-64d43a7bb599",
      "id": "GHSA-mhm7-754m-9p8w",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-mhm7-754m-9p8w affects version 2.12.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
      },
      "affects": [
        {
          "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1-tuxcare.1"
    }
  ]
}