{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:ea27b135-089c-576b-8416-f525b9981ff3",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:pypi/pyjwt@1.7.1.post2+tuxcare",
      "type": "library",
      "name": "pyjwt",
      "version": "1.7.1.post2+tuxcare",
      "purl": "pkg:pypi/pyjwt@1.7.1.post2+tuxcare"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:9835d892-af97-510b-bf25-8dd9d75300e4",
      "id": "CVE-2022-29217",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-29217 is fixed in version 1.7.1.post2+tuxcare of pyjwt."
      },
      "affects": [
        {
          "ref": "pkg:pypi/pyjwt@1.7.1.post2+tuxcare"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:3501b429-afaf-53f3-9893-3049a3cfcb9c",
      "id": "CVE-2026-32597",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-32597 is fixed in version 1.7.1.post2+tuxcare of pyjwt."
      },
      "affects": [
        {
          "ref": "pkg:pypi/pyjwt@1.7.1.post2+tuxcare"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:587bfc7d-d8d0-53c5-9723-e1b747eca35b",
      "id": "CVE-2026-48522",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-48522 does not affect version 1.7.1.post2+tuxcare of pyjwt. not_affected \u2014 Version 1.7.1 is not affected by CVE-2026-48522. The vulnerability concerns PyJWKClient accepting non-HTTP(S) URL schemes (file://, ftp://, data:) without validation, enabling local file read and SSRF. However, PyJWKClient class does not exist in version 1.7.1 - it was introduced in later versions (tested vulnerable in 2.11.0 and 2.12.1). The affected component and its entire remote JWKS fetchi..."
      },
      "affects": [
        {
          "ref": "pkg:pypi/pyjwt@1.7.1.post2+tuxcare"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:8d7fab7b-a3fc-52ff-bf93-ec8672d81f28",
      "id": "CVE-2026-48524",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-48524 does not affect version 1.7.1.post2+tuxcare of pyjwt. not_affected \u2014 PyJWT version 1.7.1 is not affected by CVE-2026-48524. The vulnerability concerns PyJWKClient.fetch_data() clearing the JWKS cache on fetch errors, enabling unlimited HTTP requests. PyJWKClient was introduced in PyJWT 2.0.0 (2021), and this target version 1.7.1 (2018) predates that feature entirely. No JWKS fetching capability, no cache mechanism, and no code path exists for the vulnerability p..."
      },
      "affects": [
        {
          "ref": "pkg:pypi/pyjwt@1.7.1.post2+tuxcare"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:7d4c75ea-db41-54f4-a198-1181c1515023",
      "id": "CVE-2026-48525",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-48525 affects version 1.7.1.post2+tuxcare of pyjwt."
      },
      "affects": [
        {
          "ref": "pkg:pypi/pyjwt@1.7.1.post2+tuxcare"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:71d4e9ee-1031-516c-af96-321dc094fa39",
      "id": "CVE-2026-48526",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-48526 affects version 1.7.1.post2+tuxcare of pyjwt."
      },
      "affects": [
        {
          "ref": "pkg:pypi/pyjwt@1.7.1.post2+tuxcare"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:pypi/pyjwt@1.7.1.post2+tuxcare"
    }
  ]
}