{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:42eb24b1-bbcd-5734-a048-7ec0d1a6f094",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:maven/org.apache.logging.log4j/log4j-layout-template-json@2.22.1-tuxcare.3",
      "type": "library",
      "group": "org.apache.logging.log4j",
      "name": "log4j-layout-template-json",
      "version": "2.22.1-tuxcare.3",
      "purl": "pkg:maven/org.apache.logging.log4j/log4j-layout-template-json@2.22.1-tuxcare.3"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:4d9b8f6b-e095-5395-95a2-cbdec12e2a74",
      "id": "CVE-2014-8180",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2014-8180 is a false positive for org.apache.logging.log4j:log4j-layout-template-json 2.22.1-tuxcare.3."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.logging.log4j/log4j-layout-template-json@2.22.1-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:95aa844d-8238-574f-988b-3921aad6fd10",
      "id": "CVE-2016-6494",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2016-6494 is a false positive for org.apache.logging.log4j:log4j-layout-template-json 2.22.1-tuxcare.3."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.logging.log4j/log4j-layout-template-json@2.22.1-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:28ca6e06-412a-570e-9531-bda6d6a89bce",
      "id": "CVE-2021-32036",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2021-32036 is a false positive for org.apache.logging.log4j:log4j-layout-template-json 2.22.1-tuxcare.3."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.logging.log4j/log4j-layout-template-json@2.22.1-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:4f1024f9-1a7b-5780-acaf-dcedec24f46e",
      "id": "CVE-2021-38295",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2021-38295 is a false positive for org.apache.logging.log4j:log4j-layout-template-json 2.22.1-tuxcare.3."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.logging.log4j/log4j-layout-template-json@2.22.1-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:1ebe64ec-4cf5-5662-96e4-9c8c55db4009",
      "id": "CVE-2022-24706",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2022-24706 is a false positive for org.apache.logging.log4j:log4j-layout-template-json 2.22.1-tuxcare.3."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.logging.log4j/log4j-layout-template-json@2.22.1-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:df2ac656-1b26-5fd2-a70f-9ea09135b635",
      "id": "CVE-2023-26268",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2023-26268 is a false positive for org.apache.logging.log4j:log4j-layout-template-json 2.22.1-tuxcare.3."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.logging.log4j/log4j-layout-template-json@2.22.1-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:b0aefb1c-69f3-5539-93e0-201c24545d2b",
      "id": "CVE-2023-45725",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2023-45725 is a false positive for org.apache.logging.log4j:log4j-layout-template-json 2.22.1-tuxcare.3."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.logging.log4j/log4j-layout-template-json@2.22.1-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:6b544101-1afe-574d-90e5-f8491df5eb9f",
      "id": "CVE-2025-68161",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-68161 is fixed in version 2.22.1-tuxcare.3 of org.apache.logging.log4j:log4j-layout-template-json."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.logging.log4j/log4j-layout-template-json@2.22.1-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:8d5d081b-6751-5486-bc25-c4e0a3cd78d5",
      "id": "CVE-2026-34477",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-34477 affects version 2.22.1-tuxcare.3 of org.apache.logging.log4j:log4j-layout-template-json."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.logging.log4j/log4j-layout-template-json@2.22.1-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:08fc4015-689a-5fbc-abb8-e1724e83584b",
      "id": "CVE-2026-34478",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-34478 does not affect version 2.22.1-tuxcare.3 of org.apache.logging.log4j:log4j-layout-template-json. Version not vulnerable (per prereq analysis); terminalized."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.logging.log4j/log4j-layout-template-json@2.22.1-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:14b3b3bd-0ee9-5c4d-98ca-82f7b412ac87",
      "id": "CVE-2026-34479",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-34479 is fixed in version 2.22.1-tuxcare.3 of org.apache.logging.log4j:log4j-layout-template-json."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.logging.log4j/log4j-layout-template-json@2.22.1-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:188e0c53-1d3b-54f2-b966-e5dba4f4b1f4",
      "id": "CVE-2026-34480",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-34480 does not affect version 2.22.1-tuxcare.3 of org.apache.logging.log4j:log4j-layout-template-json. Version 2.22.1 is not vulnerable. Summary: The target repository version 2.22.1-tuxcare.1 is NOT VULNERABLE to CVE-2026-34480. While the XmlLayout feature exists, the sanitization fix that addresses the vulnerability has been backported and is fully implemented in the current codebase. [terminalized not_affected from patch_application_manual/not_vulnerable]"
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.logging.log4j/log4j-layout-template-json@2.22.1-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:474ae12e-c900-5cf1-a0e4-79ff8be102af",
      "id": "CVE-2026-34481",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-34481 is fixed in version 2.22.1-tuxcare.3 of org.apache.logging.log4j:log4j-layout-template-json."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.logging.log4j/log4j-layout-template-json@2.22.1-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:55feed48-2911-58b8-a92b-05effbeec15e",
      "id": "CVE-2026-49844",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-49844 is fixed in version 2.22.1-tuxcare.3 of org.apache.logging.log4j:log4j-layout-template-json."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.apache.logging.log4j/log4j-layout-template-json@2.22.1-tuxcare.3"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.logging.log4j/log4j-layout-template-json@2.22.1-tuxcare.3"
    }
  ]
}