{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:3931c7fb-f920-5ef5-8b5d-e7dfc412db54",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:npm/js-yaml@3.7.0-tuxcare.2",
      "type": "library",
      "name": "js-yaml",
      "version": "3.7.0-tuxcare.2",
      "purl": "pkg:npm/js-yaml@3.7.0-tuxcare.2"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:c113b5a4-4990-5d8a-9fc4-7c3752b1cbbf",
      "id": "CVE-2025-64718",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-64718 is fixed in version 3.7.0-tuxcare.2 of js-yaml."
      },
      "affects": [
        {
          "ref": "pkg:npm/js-yaml@3.7.0-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:56c06776-7768-5898-a262-c1aea1d72037",
      "id": "CVE-2026-53550",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-53550 does not affect version 3.7.0-tuxcare.2 of js-yaml. not_affected \u2014 The target version 3.7.0-tuxcare.2 is not affected by CVE-2026-53550. While the vulnerable code pattern (merge array processing without deduplication) is present in lib/js-yaml/loader.js:342-349, an alternative runtime defense (maxTotalMergeKeys, default limit 10,000) prevents the CPU exhaustion DoS attack. This defense was added by TuxCare in commit 52bfa4a for CVE-2026-59868 and also mitigate..."
      },
      "affects": [
        {
          "ref": "pkg:npm/js-yaml@3.7.0-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:b4cdd923-da53-5222-883b-4ffda5b90666",
      "id": "CVE-2026-59868",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59868 is fixed in version 3.7.0-tuxcare.2 of js-yaml."
      },
      "affects": [
        {
          "ref": "pkg:npm/js-yaml@3.7.0-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:9b518270-dc73-5069-a869-d5baa1cca123",
      "id": "CVE-2026-59869",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-59869 affects version 3.7.0-tuxcare.2 of js-yaml."
      },
      "affects": [
        {
          "ref": "pkg:npm/js-yaml@3.7.0-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:14226512-ed96-5350-bd95-696f8bf95fdc",
      "id": "CVE-2026-59870",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-59870 affects version 3.7.0-tuxcare.2 of js-yaml."
      },
      "affects": [
        {
          "ref": "pkg:npm/js-yaml@3.7.0-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:76740e15-6dc7-5ba2-8f77-0d623068d0f0",
      "id": "CVE-2026-73643",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-73643 does not affect version 3.7.0-tuxcare.2 of js-yaml. Version 3.7.0 is not affected by CVE-2026-73643. The vulnerability describes an exponential time complexity issue in js-yaml versions 5.0.0-5.2.1 caused by a specific architectural pattern: when readFlowCollection parses a flow sequence as a key in a key-value pair, it uses restoreState to rewind the parser and calls parseNode a second time, causing O(2^n) complexity for nested flow sequences. This mechanism does not exist in version 3.7.0. The target version uses a fundamentally different architecture (JavaScript with no state snapshot capability) that predates the TypeScript rewrite in version 5.0.0 where the vulnerability was introduced. In 3.7.0, each node is parsed exactly once using composeNode with no backtracking, resulting in normal O(n) recursive descent parsing. The vulnerable code pattern is absent from this version's codebase."
      },
      "affects": [
        {
          "ref": "pkg:npm/js-yaml@3.7.0-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:f7413ea1-9b62-5fc0-8294-b6a707f2675b",
      "id": "GHSA-2pr6-76vf-7546",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-2pr6-76vf-7546 is fixed in version 3.7.0-tuxcare.2 of js-yaml."
      },
      "affects": [
        {
          "ref": "pkg:npm/js-yaml@3.7.0-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:2e0b2dc4-3e51-5f78-a95d-5ed3323dd5a1",
      "id": "GHSA-5p4m-2wfm-xmqj",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-5p4m-2wfm-xmqj affects version 3.7.0-tuxcare.2 of js-yaml."
      },
      "affects": [
        {
          "ref": "pkg:npm/js-yaml@3.7.0-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:ca4f711f-8271-5814-aa6a-22d34e14d255",
      "id": "GHSA-8j8c-7jfh-h6hx",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-8j8c-7jfh-h6hx is fixed in version 3.7.0-tuxcare.2 of js-yaml."
      },
      "affects": [
        {
          "ref": "pkg:npm/js-yaml@3.7.0-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:327ae4ed-b322-5e0b-ba5a-efd184188584",
      "id": "GHSA-pm4m-ph32-ghv5",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability GHSA-pm4m-ph32-ghv5 does not affect version 3.7.0-tuxcare.2 of js-yaml. not_affected \u2014 js-yaml version 3.7.0 is not affected by GHSA-pm4m-ph32-ghv5. The exponential-time parsing vulnerability described in the CVE relies on a rewind-and-reparse mechanism that does not exist in this version. The code parses flow sequence entries exactly once and reuses the result when they turn out to be keys, resulting in O(n) parsing time rather than the O(2^n) behavior described in the CVE."
      },
      "affects": [
        {
          "ref": "pkg:npm/js-yaml@3.7.0-tuxcare.2"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/js-yaml@3.7.0-tuxcare.2"
    }
  ]
}