{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:6db80b79-d43d-5d31-a1fa-099203bf0f9f",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.8",
      "type": "library",
      "group": "org.springframework",
      "name": "spring-expression",
      "version": "5.3.31-tuxcare.8",
      "purl": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.8"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:ef410be3-cc58-5fbe-bf88-87cc62e17801",
      "id": "CVE-2016-1000027",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.31-tuxcare.8 of org.springframework:spring-expression."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:65adb69e-a94b-5db4-bcf9-33ed289b9939",
      "id": "CVE-2024-22243",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.31-tuxcare.8 of org.springframework:spring-expression."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:998bc189-2d6a-5fba-9950-accc6417f7ab",
      "id": "CVE-2024-22259",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.31-tuxcare.8 of org.springframework:spring-expression."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:a97480bc-4a3c-5b4b-ad4c-bb330c083893",
      "id": "CVE-2024-22262",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.31-tuxcare.8 of org.springframework:spring-expression."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:0aa7c345-d008-5a76-92c6-1a35e86f842c",
      "id": "CVE-2024-38808",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.31-tuxcare.8 of org.springframework:spring-expression."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:89ee09f0-0c3e-5e25-90d0-52a8bf8dbab9",
      "id": "CVE-2024-38809",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.31-tuxcare.8 of org.springframework:spring-expression."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:0fc25f80-37e5-52b8-8be2-6dabadd522a9",
      "id": "CVE-2024-38816",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.31-tuxcare.8 of org.springframework:spring-expression."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:1d0e6d3b-1881-58a7-b719-f6e82082df72",
      "id": "CVE-2024-38819",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.31-tuxcare.8 of org.springframework:spring-expression."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:df39dd86-f0a6-59bb-bf5c-a12804406b59",
      "id": "CVE-2024-38820",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.31-tuxcare.8 of org.springframework:spring-expression."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:62da825b-9090-5241-b293-c99c2e9034b6",
      "id": "CVE-2024-38828",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.31-tuxcare.8 of org.springframework:spring-expression."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:257f4798-0fb6-5c53-9fce-422820c16688",
      "id": "CVE-2025-22233",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.31-tuxcare.8 of org.springframework:spring-expression."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:0bbfd768-7e56-55db-b57e-3e8646d3b688",
      "id": "CVE-2025-41234",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring-expression 5.3.31-tuxcare.8."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:90ee614e-d9cb-59a3-8292-f39cabe0fcbd",
      "id": "CVE-2025-41242",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.31-tuxcare.8 of org.springframework:spring-expression."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:475ee1bd-7234-54f4-9f4b-1349b0417b2a",
      "id": "CVE-2025-41249",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.31-tuxcare.8 of org.springframework:spring-expression."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:646b9f67-44d6-5196-9cd7-e8a9038bfc10",
      "id": "CVE-2025-41254",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.31-tuxcare.8 of org.springframework:spring-expression."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:4a10fea9-c7e0-5fc8-beaf-8a263d3f6c2f",
      "id": "CVE-2026-22735",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.31-tuxcare.8 of org.springframework:spring-expression."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:2142c238-4b9f-5ca0-80e1-8567cde41197",
      "id": "CVE-2026-22737",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.31-tuxcare.8 of org.springframework:spring-expression."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:aa1e115d-df34-5c32-a69f-9c4e50765a0f",
      "id": "CVE-2026-22740",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.31-tuxcare.8 of org.springframework:spring-expression."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:b3ab886b-815d-5487-b3bc-b92ebe8edc1f",
      "id": "CVE-2026-22741",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-22741 affects version 5.3.31-tuxcare.8 of org.springframework:spring-expression."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:e8b8a5b4-8750-5a86-b92e-9f2685f28c59",
      "id": "CVE-2026-22745",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.31-tuxcare.8 of org.springframework:spring-expression."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:222651d1-577c-5455-9d41-956751e2abda",
      "id": "CVE-2026-41838",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.31-tuxcare.8 of org.springframework:spring-expression."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:9ecc2ab0-19d7-56b1-808b-609175ae1d21",
      "id": "CVE-2026-41839",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.31-tuxcare.8 of org.springframework:spring-expression."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:3c892be9-49fa-59af-b290-c2b94ec83c88",
      "id": "CVE-2026-41840",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.31-tuxcare.8 of org.springframework:spring-expression. already_fixed \u2014 The target repository (Spring Framework 5.3.31-tuxcare.3) already contains the complete fix for CVE-2026-41840. Both required doOnDiscard handlers were applied via commit 615477c88f (labeled as CVE-2026-22740 backport) merged on May 4, 2026. The code changes are byte-for-byte identical to the upstream patches."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:bfc3d0f3-9510-501e-9243-99068001a9c7",
      "id": "CVE-2026-41841",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41841 affects version 5.3.31-tuxcare.8 of org.springframework:spring-expression."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:5a7179bc-d244-539a-a6ca-58eb9f7b783d",
      "id": "CVE-2026-41842",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41842 affects version 5.3.31-tuxcare.8 of org.springframework:spring-expression."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:05eb6b17-c9f1-5c87-aabc-517d9c2e1485",
      "id": "CVE-2026-41843",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41843 affects version 5.3.31-tuxcare.8 of org.springframework:spring-expression."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d65ec181-db6f-56ed-887a-d9579206b185",
      "id": "CVE-2026-41844",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.31-tuxcare.8 of org.springframework:spring-expression."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:92b98d19-6626-5a74-828d-7e27816ec2ce",
      "id": "CVE-2026-41845",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.31-tuxcare.8 of org.springframework:spring-expression."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:dcd9912a-ad39-5329-9895-36c039f31dcd",
      "id": "CVE-2026-41846",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41846 affects version 5.3.31-tuxcare.8 of org.springframework:spring-expression."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:c11515de-3c3d-5639-a675-6f875404c66d",
      "id": "CVE-2026-41847",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41847 affects version 5.3.31-tuxcare.8 of org.springframework:spring-expression."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:e19fb43c-6a9e-5793-b83c-868c6ad8921d",
      "id": "CVE-2026-41848",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.31-tuxcare.8 of org.springframework:spring-expression."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:81089872-8543-5c68-a7b7-c010d57af5e2",
      "id": "CVE-2026-41849",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.31-tuxcare.8 of org.springframework:spring-expression."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:50690516-a1a7-59c1-a2b3-bf58ab2f1d0f",
      "id": "CVE-2026-41850",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41850 affects version 5.3.31-tuxcare.8 of org.springframework:spring-expression."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d97f3b69-a38e-5843-bbbb-02a73e8ad328",
      "id": "CVE-2026-41851",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41851 affects version 5.3.31-tuxcare.8 of org.springframework:spring-expression."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:49a13a2d-6566-5bc6-8bd7-dd6f129bc9cd",
      "id": "CVE-2026-41852",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41852 affects version 5.3.31-tuxcare.8 of org.springframework:spring-expression."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:b49dc6f6-3131-5276-898a-0744db484ca2",
      "id": "CVE-2026-41853",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.31-tuxcare.8 of org.springframework:spring-expression."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:f7b2a78d-cfc0-50cd-a315-da655619d2b6",
      "id": "CVE-2026-41855",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.31-tuxcare.8 of org.springframework:spring-expression."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.8"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.8"
    }
  ]
}