{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:c56da255-7a04-51df-a3fb-8ae66fa04ca3",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:maven/org.springframework/spring-context@5.3.39-tuxcare.16",
      "type": "library",
      "group": "org.springframework",
      "name": "spring-context",
      "version": "5.3.39-tuxcare.16",
      "purl": "pkg:maven/org.springframework/spring-context@5.3.39-tuxcare.16"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:1e3a1f6d-0741-5714-a818-b98b152480ca",
      "id": "CVE-2016-1000027",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.39-tuxcare.16 of org.springframework:spring-context."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.39-tuxcare.16"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:2266f9b7-b653-5da9-9f29-16518f107894",
      "id": "CVE-2022-22968",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22968 does not affect version 5.3.39-tuxcare.16 of org.springframework:spring-context. Spring version 5.3.39 is not affected to CVE-2022-22968 as fix has been already already backported by the original developers"
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.39-tuxcare.16"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:3b0dccda-56d6-53cd-b721-b0bd37456d90",
      "id": "CVE-2024-38816",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.39-tuxcare.16 of org.springframework:spring-context."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.39-tuxcare.16"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:69cfb918-8838-57d5-9c37-48ae5de7cbb1",
      "id": "CVE-2024-38819",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.39-tuxcare.16 of org.springframework:spring-context."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.39-tuxcare.16"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:6ff63c51-9e9d-5aca-9e30-73a72ed955e4",
      "id": "CVE-2024-38820",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.39-tuxcare.16 of org.springframework:spring-context."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.39-tuxcare.16"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:5b0c9bc7-e1e1-5ccf-9e0a-26baaf2ac640",
      "id": "CVE-2024-38828",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.39-tuxcare.16 of org.springframework:spring-context."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.39-tuxcare.16"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:474d81ed-26fe-5769-9437-843cd7a1df9c",
      "id": "CVE-2025-22233",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.39-tuxcare.16 of org.springframework:spring-context."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.39-tuxcare.16"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:65b017cc-e19b-5cc7-b076-12d4e7b41b24",
      "id": "CVE-2025-41234",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring-context 5.3.39-tuxcare.16."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.39-tuxcare.16"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:2f5c1a3d-e32b-515a-9d22-920436443fd5",
      "id": "CVE-2025-41242",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.39-tuxcare.16 of org.springframework:spring-context."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.39-tuxcare.16"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:8c3222bf-69c1-513c-beee-65b7b47650db",
      "id": "CVE-2025-41249",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.39-tuxcare.16 of org.springframework:spring-context."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.39-tuxcare.16"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:cf0c3528-7bf2-5a8f-93d0-e030f6f9cd6e",
      "id": "CVE-2025-41254",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.39-tuxcare.16 of org.springframework:spring-context."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.39-tuxcare.16"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:885c12c1-79e5-56ef-bbbe-e829c2495f11",
      "id": "CVE-2026-22735",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.39-tuxcare.16 of org.springframework:spring-context."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.39-tuxcare.16"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:847111da-d70b-58e2-90be-8751fb55fc9d",
      "id": "CVE-2026-22737",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.39-tuxcare.16 of org.springframework:spring-context."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.39-tuxcare.16"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:f5bc7ccb-ae7e-5ab1-8d2d-8e3ec5bbefaa",
      "id": "CVE-2026-22740",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.39-tuxcare.16 of org.springframework:spring-context."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.39-tuxcare.16"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:41eea6ad-d1af-5a1c-b7a4-3413613b0f83",
      "id": "CVE-2026-22741",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.39-tuxcare.16 of org.springframework:spring-context."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.39-tuxcare.16"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:a67ebe19-0cb2-5f5d-afde-15680f871948",
      "id": "CVE-2026-22745",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.39-tuxcare.16 of org.springframework:spring-context."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.39-tuxcare.16"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:435632c9-e7a8-586e-b7b5-8f54c5a270a1",
      "id": "CVE-2026-41838",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.39-tuxcare.16 of org.springframework:spring-context."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.39-tuxcare.16"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:bb629ed7-a368-5f49-a870-21687d2958d8",
      "id": "CVE-2026-41839",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.39-tuxcare.16 of org.springframework:spring-context."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.39-tuxcare.16"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:8fd2fa73-58c1-58fa-824d-62564d82b451",
      "id": "CVE-2026-41840",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.39-tuxcare.16 of org.springframework:spring-context. already_fixed \u2014 The target Spring Framework 5.3.39-tuxcare.12 already contains both vendor fixes for CVE-2026-41840. The fixes were backported via commit 4ef4cdca34 (May 13, 2026) under CVE-2026-22740, but the code changes are identical to the upstream patches. Both doOnDiscard handlers are present and active in PartGenerator.java and MultipartHttpMessageReader.java, preventing memory exhaustion from unrelease..."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.39-tuxcare.16"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d3379a94-9281-5a74-8b34-8749a2bae2a9",
      "id": "CVE-2026-41841",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41841 affects version 5.3.39-tuxcare.16 of org.springframework:spring-context."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.39-tuxcare.16"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:09c5f154-459e-5538-9bd5-a97287961994",
      "id": "CVE-2026-41842",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.39-tuxcare.16 of org.springframework:spring-context."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.39-tuxcare.16"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:00b6077f-bee7-58db-ab04-d2249d6e3029",
      "id": "CVE-2026-41843",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41843 affects version 5.3.39-tuxcare.16 of org.springframework:spring-context."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.39-tuxcare.16"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:7a65b361-8757-5ed1-b76d-5b4f0852b2ed",
      "id": "CVE-2026-41844",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.39-tuxcare.16 of org.springframework:spring-context."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.39-tuxcare.16"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:4fc30a1f-21e8-5a20-9ec9-11a56df35a12",
      "id": "CVE-2026-41845",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.39-tuxcare.16 of org.springframework:spring-context."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.39-tuxcare.16"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:df93a029-dcdd-5818-9768-13a46b990458",
      "id": "CVE-2026-41846",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.39-tuxcare.16 of org.springframework:spring-context."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.39-tuxcare.16"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:af7f4b33-2948-533b-bf8e-98bf7479649f",
      "id": "CVE-2026-41847",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.39-tuxcare.16 of org.springframework:spring-context."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.39-tuxcare.16"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:ff3be9da-f070-5c3e-95f9-3790e41b25bf",
      "id": "CVE-2026-41848",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.39-tuxcare.16 of org.springframework:spring-context."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.39-tuxcare.16"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:b715d494-e183-5100-8363-f57020de644b",
      "id": "CVE-2026-41849",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41849 affects version 5.3.39-tuxcare.16 of org.springframework:spring-context."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.39-tuxcare.16"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:052cdced-8852-5da6-bb5b-4f2eb09e3b20",
      "id": "CVE-2026-41850",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.39-tuxcare.16 of org.springframework:spring-context."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.39-tuxcare.16"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:f9d15036-decb-58ed-bcc9-f64ce003ffad",
      "id": "CVE-2026-41851",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41851 is fixed in version 5.3.39-tuxcare.16 of org.springframework:spring-context."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.39-tuxcare.16"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:ead00a9b-f96f-50dc-b2c2-b8df4ff1010f",
      "id": "CVE-2026-41852",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.39-tuxcare.16 of org.springframework:spring-context."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.39-tuxcare.16"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:b5e0499c-7a22-5b2e-b537-a6997061ff6d",
      "id": "CVE-2026-41853",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41853 affects version 5.3.39-tuxcare.16 of org.springframework:spring-context."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.39-tuxcare.16"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d06d7298-f27b-5808-985a-39daee58c2a3",
      "id": "CVE-2026-41855",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.39-tuxcare.16 of org.springframework:spring-context."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.39-tuxcare.16"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-context@5.3.39-tuxcare.16"
    }
  ]
}