{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:bb1a31ca-016b-53be-8597-05684cfb6f16",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:npm/js-yaml@3.7.0-tuxcare.1",
      "type": "library",
      "name": "js-yaml",
      "version": "3.7.0-tuxcare.1",
      "purl": "pkg:npm/js-yaml@3.7.0-tuxcare.1"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:4191db97-a32e-59c8-981a-1395e908568d",
      "id": "CVE-2025-64718",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-64718 is fixed in version 3.7.0-tuxcare.1 of js-yaml."
      },
      "affects": [
        {
          "ref": "pkg:npm/js-yaml@3.7.0-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d84fc2f7-895b-5e8a-b219-a523f844ed9c",
      "id": "CVE-2026-53550",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-53550 does not affect version 3.7.0-tuxcare.1 of js-yaml. not_affected \u2014 The target version 3.7.0-tuxcare.2 is not affected by CVE-2026-53550. While the vulnerable code pattern (merge array processing without deduplication) is present in lib/js-yaml/loader.js:342-349, an alternative runtime defense (maxTotalMergeKeys, default limit 10,000) prevents the CPU exhaustion DoS attack. This defense was added by TuxCare in commit 52bfa4a for CVE-2026-59868 and also mitigate..."
      },
      "affects": [
        {
          "ref": "pkg:npm/js-yaml@3.7.0-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:42d1ba3d-b2f2-5ba7-b392-f20deda89305",
      "id": "CVE-2026-59868",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-59868 affects version 3.7.0-tuxcare.1 of js-yaml."
      },
      "affects": [
        {
          "ref": "pkg:npm/js-yaml@3.7.0-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:af3f75ac-3bc2-5ec0-aeec-8ca1440cf1e9",
      "id": "CVE-2026-59869",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-59869 affects version 3.7.0-tuxcare.1 of js-yaml."
      },
      "affects": [
        {
          "ref": "pkg:npm/js-yaml@3.7.0-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:7100a908-2966-5196-b1bc-43769db2f386",
      "id": "CVE-2026-59870",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-59870 affects version 3.7.0-tuxcare.1 of js-yaml."
      },
      "affects": [
        {
          "ref": "pkg:npm/js-yaml@3.7.0-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:bd722dd6-a404-5332-8c98-4f69a08e1899",
      "id": "GHSA-2pr6-76vf-7546",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-2pr6-76vf-7546 is fixed in version 3.7.0-tuxcare.1 of js-yaml."
      },
      "affects": [
        {
          "ref": "pkg:npm/js-yaml@3.7.0-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:0a3e65c0-6403-5ca7-b31a-55a56d06a326",
      "id": "GHSA-5p4m-2wfm-xmqj",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-5p4m-2wfm-xmqj affects version 3.7.0-tuxcare.1 of js-yaml."
      },
      "affects": [
        {
          "ref": "pkg:npm/js-yaml@3.7.0-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:77d48ec8-899b-54e4-8e76-32102176d9df",
      "id": "GHSA-8j8c-7jfh-h6hx",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-8j8c-7jfh-h6hx is fixed in version 3.7.0-tuxcare.1 of js-yaml."
      },
      "affects": [
        {
          "ref": "pkg:npm/js-yaml@3.7.0-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:17e18228-4a90-5cb7-9793-9e2b78189bea",
      "id": "GHSA-pm4m-ph32-ghv5",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability GHSA-pm4m-ph32-ghv5 does not affect version 3.7.0-tuxcare.1 of js-yaml. not_affected \u2014 js-yaml version 3.7.0 is not affected by GHSA-pm4m-ph32-ghv5. The exponential-time parsing vulnerability described in the CVE relies on a rewind-and-reparse mechanism that does not exist in this version. The code parses flow sequence entries exactly once and reuses the result when they turn out to be keys, resulting in O(n) parsing time rather than the O(2^n) behavior described in the CVE."
      },
      "affects": [
        {
          "ref": "pkg:npm/js-yaml@3.7.0-tuxcare.1"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/js-yaml@3.7.0-tuxcare.1"
    }
  ]
}