{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:074b8eb5-4400-5c37-9e65-89cb0724fed0",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.8",
      "type": "library",
      "group": "org.springframework",
      "name": "spring-context",
      "version": "5.3.37-tuxcare.8",
      "purl": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.8"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:ff7f6129-db68-5f50-a1cb-ff1d775f1cd1",
      "id": "CVE-2016-1000027",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.37-tuxcare.8 of org.springframework:spring-context."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:792edf90-46ea-5ae9-9147-66ec31e31aeb",
      "id": "CVE-2024-38808",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.37-tuxcare.8 of org.springframework:spring-context."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:ffc421df-41db-5b77-8b0e-fa9d29bdcec7",
      "id": "CVE-2024-38809",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.37-tuxcare.8 of org.springframework:spring-context."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:25a9d7b8-581a-5f6b-84ac-6bb01a6cac5c",
      "id": "CVE-2024-38816",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.37-tuxcare.8 of org.springframework:spring-context."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:b6b8e77a-afef-5199-afb3-ec9d194dacef",
      "id": "CVE-2024-38819",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.37-tuxcare.8 of org.springframework:spring-context."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:0e1d8042-ab54-54fa-8abb-951e0ef23ace",
      "id": "CVE-2024-38820",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.37-tuxcare.8 of org.springframework:spring-context."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:77e91f9d-4b86-5c80-aca7-7f430f4b2b72",
      "id": "CVE-2024-38828",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.37-tuxcare.8 of org.springframework:spring-context."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:581a9491-7621-53e5-a284-745e58290784",
      "id": "CVE-2025-22233",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.37-tuxcare.8 of org.springframework:spring-context."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:6f647589-4f66-561c-bbfe-e9cedc5600c7",
      "id": "CVE-2025-41242",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-41242 affects version 5.3.37-tuxcare.8 of org.springframework:spring-context."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:dc9c9ebb-9d9f-5dee-b5b7-9b0a8ff7664d",
      "id": "CVE-2025-41249",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.37-tuxcare.8 of org.springframework:spring-context."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:6f1d1a42-d9e9-58a3-939e-ef4be4e8f555",
      "id": "CVE-2025-41254",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-41254 affects version 5.3.37-tuxcare.8 of org.springframework:spring-context."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:7f09319e-3b6c-5340-bece-6f9f2a9cfdae",
      "id": "CVE-2026-22735",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.37-tuxcare.8 of org.springframework:spring-context."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:8dc8feac-65ec-5ec8-9529-447ce1318dd3",
      "id": "CVE-2026-22737",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.37-tuxcare.8 of org.springframework:spring-context."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:c22e5603-065b-5f1d-aa42-5cf14b1df7c9",
      "id": "CVE-2026-22740",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.37-tuxcare.8 of org.springframework:spring-context."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:0aa0d56c-6ed6-5c0a-8c4c-7bfc4b079639",
      "id": "CVE-2026-22741",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.37-tuxcare.8 of org.springframework:spring-context."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:19df684a-f2d5-5093-a325-1d1952d235f3",
      "id": "CVE-2026-22745",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.37-tuxcare.8 of org.springframework:spring-context."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:4d264ba3-335b-58f2-9327-6704604c6998",
      "id": "CVE-2026-41838",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.37-tuxcare.8 of org.springframework:spring-context."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:4437d9ae-295a-5eda-a3cb-f0b6048b84d4",
      "id": "CVE-2026-41839",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41839 affects version 5.3.37-tuxcare.8 of org.springframework:spring-context."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:da146892-2438-53f5-bd22-fa074770b2ed",
      "id": "CVE-2026-41840",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.37-tuxcare.8 of org.springframework:spring-context. already_fixed \u2014 The target repository (Spring Framework 5.3.37-tuxcare.6) already contains both fixes for CVE-2026-41840. The fixes were backported on June 8, 2026 via commit 648b33d0a3 as part of CVE-2026-22740 remediation, which addresses the same multipart memory leak vulnerability."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:469c7182-54b5-5623-a838-0bf717f72b14",
      "id": "CVE-2026-41841",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41841 affects version 5.3.37-tuxcare.8 of org.springframework:spring-context."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d7082480-7c92-57d6-98fd-e5720c50177d",
      "id": "CVE-2026-41842",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41842 affects version 5.3.37-tuxcare.8 of org.springframework:spring-context."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:6d72d167-921a-54a0-9dc7-b7ac999a0195",
      "id": "CVE-2026-41843",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41843 affects version 5.3.37-tuxcare.8 of org.springframework:spring-context."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:99c0d929-96ca-55ae-9435-764f36cdddb3",
      "id": "CVE-2026-41844",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.37-tuxcare.8 of org.springframework:spring-context."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:af9540ca-854b-5c0f-8a03-0be7739e3ad9",
      "id": "CVE-2026-41845",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.37-tuxcare.8 of org.springframework:spring-context."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:5cab772f-e8b9-504b-9cde-bf4760e13891",
      "id": "CVE-2026-41846",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41846 affects version 5.3.37-tuxcare.8 of org.springframework:spring-context."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:612108d5-43cf-5e1e-909f-5e5247714187",
      "id": "CVE-2026-41847",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41847 affects version 5.3.37-tuxcare.8 of org.springframework:spring-context."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:7f04d568-4303-5ace-8bba-8b5dca60d9e3",
      "id": "CVE-2026-41848",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41848 affects version 5.3.37-tuxcare.8 of org.springframework:spring-context."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:7762c746-23bb-5e0b-a4cf-bcfcbf74da4d",
      "id": "CVE-2026-41849",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41849 does not affect version 5.3.37-tuxcare.8 of org.springframework:spring-context. Already patched: all patch commits for CVE-2026-41849 already present in target branch (momus prerequisite AllPatchCommitsAlreadyInTarget)."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:77ae1ec4-790c-5393-a7ad-4d5823751bda",
      "id": "CVE-2026-41850",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41850 affects version 5.3.37-tuxcare.8 of org.springframework:spring-context."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:bc7e0983-07c6-5834-a13c-9a8f85b24a67",
      "id": "CVE-2026-41851",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41851 affects version 5.3.37-tuxcare.8 of org.springframework:spring-context."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:df4ba808-4d69-5d6f-b55a-3131179460bc",
      "id": "CVE-2026-41852",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41852 affects version 5.3.37-tuxcare.8 of org.springframework:spring-context."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:563fb54d-8a4e-5567-a3bd-8e27200b9969",
      "id": "CVE-2026-41853",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41853 affects version 5.3.37-tuxcare.8 of org.springframework:spring-context."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:e3ac04e1-500a-5ec5-944f-be78466fe708",
      "id": "CVE-2026-41855",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41855 affects version 5.3.37-tuxcare.8 of org.springframework:spring-context."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.8"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-context@5.3.37-tuxcare.8"
    }
  ]
}