{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:01828c99-9ec9-56d3-8c56-67f046555761",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:maven/org.apache.cxf.services.sts/cxf-services-sts-core@3.4.5-tuxcare.1",
      "type": "library",
      "group": "org.apache.cxf.services.sts",
      "name": "cxf-services-sts-core",
      "version": "3.4.5-tuxcare.1",
      "purl": "pkg:maven/org.apache.cxf.services.sts/cxf-services-sts-core@3.4.5-tuxcare.1"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:fdf3dbe3-10ed-5e70-b7fb-d9688de4a716",
      "id": "CVE-2022-46363",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-46363 is fixed in version 3.4.5-tuxcare.1 of org.apache.cxf.services.sts:cxf-services-sts-core."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.cxf.services.sts/cxf-services-sts-core@3.4.5-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d9bd2dfe-8c6d-5209-b3fd-8b0e04d30801",
      "id": "CVE-2022-46364",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-46364 is fixed in version 3.4.5-tuxcare.1 of org.apache.cxf.services.sts:cxf-services-sts-core."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.cxf.services.sts/cxf-services-sts-core@3.4.5-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:b9bcaf62-3837-5aec-8765-983d62f625c7",
      "id": "CVE-2024-28752",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-28752 is fixed in version 3.4.5-tuxcare.1 of org.apache.cxf.services.sts:cxf-services-sts-core."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.cxf.services.sts/cxf-services-sts-core@3.4.5-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:6b3ec76d-5f6d-5353-b324-86a024a9d893",
      "id": "CVE-2024-29736",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-29736 is fixed in version 3.4.5-tuxcare.1 of org.apache.cxf.services.sts:cxf-services-sts-core."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.cxf.services.sts/cxf-services-sts-core@3.4.5-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:9bbbe9ca-b997-5fcc-b270-fa753ef7faf1",
      "id": "CVE-2024-32007",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-32007 is fixed in version 3.4.5-tuxcare.1 of org.apache.cxf.services.sts:cxf-services-sts-core."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.cxf.services.sts/cxf-services-sts-core@3.4.5-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:bb62f9ee-9bef-547c-b71e-5ce9cbe05d9f",
      "id": "CVE-2025-23184",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-23184 affects version 3.4.5-tuxcare.1 of org.apache.cxf.services.sts:cxf-services-sts-core."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.cxf.services.sts/cxf-services-sts-core@3.4.5-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:9f2328ec-497f-5ff2-bbe8-ae9b4030e9db",
      "id": "CVE-2025-48795",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-48795 does not affect version 3.4.5-tuxcare.1 of org.apache.cxf.services.sts:cxf-services-sts-core. not_affected \u2014 Version 3.4.5 does not contain the vulnerable code path. The CVE-2025-48795 vulnerability exists in DelayedCachedOutputStreamCleaner class which was introduced in version 3.5.11 (September 2024). Version 3.4.5 predates this component and lacks the leak detection logging mechanism that causes the vulnerability."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.cxf.services.sts/cxf-services-sts-core@3.4.5-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:927bd9c6-10e3-52f2-9d1c-34339211c7b1",
      "id": "CVE-2025-48913",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-48913 is fixed in version 3.4.5-tuxcare.1 of org.apache.cxf.services.sts:cxf-services-sts-core."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.cxf.services.sts/cxf-services-sts-core@3.4.5-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:41b4b433-58bf-5641-8741-c595916d25ad",
      "id": "CVE-2026-44417",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-44417 affects version 3.4.5-tuxcare.1 of org.apache.cxf.services.sts:cxf-services-sts-core."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.cxf.services.sts/cxf-services-sts-core@3.4.5-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:1b2fd1c2-2743-5b96-9e03-1d81bb049dee",
      "id": "CVE-2026-44618",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-44618 affects version 3.4.5-tuxcare.1 of org.apache.cxf.services.sts:cxf-services-sts-core."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.cxf.services.sts/cxf-services-sts-core@3.4.5-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:cc4c16b6-a2be-5ca0-82cd-2a73ddba31ac",
      "id": "CVE-2026-44930",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-44930 affects version 3.4.5-tuxcare.1 of org.apache.cxf.services.sts:cxf-services-sts-core."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.cxf.services.sts/cxf-services-sts-core@3.4.5-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:a1a364b0-8a77-5261-b3da-0d26e17661da",
      "id": "CVE-2026-49875",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-49875 affects version 3.4.5-tuxcare.1 of org.apache.cxf.services.sts:cxf-services-sts-core."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.cxf.services.sts/cxf-services-sts-core@3.4.5-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:c687bad7-b52a-5689-9026-c8334c86eeee",
      "id": "CVE-2026-50623",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50623 affects version 3.4.5-tuxcare.1 of org.apache.cxf.services.sts:cxf-services-sts-core."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.cxf.services.sts/cxf-services-sts-core@3.4.5-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:7957f435-070d-5592-ba52-944c0ffb8d41",
      "id": "CVE-2026-50627",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50627 affects version 3.4.5-tuxcare.1 of org.apache.cxf.services.sts:cxf-services-sts-core."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.cxf.services.sts/cxf-services-sts-core@3.4.5-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:4f3bdb9d-1b12-5cf9-93e7-96e570440898",
      "id": "CVE-2026-50628",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50628 affects version 3.4.5-tuxcare.1 of org.apache.cxf.services.sts:cxf-services-sts-core."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.cxf.services.sts/cxf-services-sts-core@3.4.5-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:a3684c2c-c7bd-5646-9d80-7e5dfe42af81",
      "id": "CVE-2026-50629",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50629 affects version 3.4.5-tuxcare.1 of org.apache.cxf.services.sts:cxf-services-sts-core."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.cxf.services.sts/cxf-services-sts-core@3.4.5-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d6c12014-1e0a-5fd7-9f10-3f8030f045ef",
      "id": "CVE-2026-50630",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50630 affects version 3.4.5-tuxcare.1 of org.apache.cxf.services.sts:cxf-services-sts-core."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.cxf.services.sts/cxf-services-sts-core@3.4.5-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:50114fc0-af19-5a50-8978-f8afc93a09bf",
      "id": "CVE-2026-50631",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50631 affects version 3.4.5-tuxcare.1 of org.apache.cxf.services.sts:cxf-services-sts-core."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.cxf.services.sts/cxf-services-sts-core@3.4.5-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:7802ddb8-798b-5f61-892f-82227a7fb762",
      "id": "CVE-2026-50632",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50632 affects version 3.4.5-tuxcare.1 of org.apache.cxf.services.sts:cxf-services-sts-core."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.cxf.services.sts/cxf-services-sts-core@3.4.5-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:4d68322d-2c53-5cf4-bb92-208fff952df7",
      "id": "CVE-2026-50633",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50633 affects version 3.4.5-tuxcare.1 of org.apache.cxf.services.sts:cxf-services-sts-core."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.cxf.services.sts/cxf-services-sts-core@3.4.5-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:fdaabdee-3615-5974-9db5-02977638bcdc",
      "id": "CVE-2026-50634",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50634 affects version 3.4.5-tuxcare.1 of org.apache.cxf.services.sts:cxf-services-sts-core."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.cxf.services.sts/cxf-services-sts-core@3.4.5-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:2e9b4220-67dc-5279-9a50-8073e57974e3",
      "id": "CVE-2026-50645",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50645 affects version 3.4.5-tuxcare.1 of org.apache.cxf.services.sts:cxf-services-sts-core."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.cxf.services.sts/cxf-services-sts-core@3.4.5-tuxcare.1"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.cxf.services.sts/cxf-services-sts-core@3.4.5-tuxcare.1"
    }
  ]
}