{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:385c4be2-0e01-5881-b0c9-5386506b7112",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@5.3.30-tuxcare.1",
      "type": "library",
      "group": "org.springframework",
      "name": "spring-messaging",
      "version": "5.3.30-tuxcare.1",
      "purl": "pkg:maven/org.springframework/spring-messaging@5.3.30-tuxcare.1"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:fdea244f-c04a-5371-b1fb-78358466aa7a",
      "id": "CVE-2016-1000027",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.30-tuxcare.1 of org.springframework:spring-messaging."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.30-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:683b0207-cfd7-51ec-93f0-cefabd448f23",
      "id": "CVE-2024-22243",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.30-tuxcare.1 of org.springframework:spring-messaging."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.30-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:1a320dc8-317d-58cc-a296-e5fc7e979388",
      "id": "CVE-2024-22259",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.30-tuxcare.1 of org.springframework:spring-messaging."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.30-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:2965c56e-a602-52a3-bffe-022b7ab1d1e6",
      "id": "CVE-2024-22262",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.30-tuxcare.1 of org.springframework:spring-messaging."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.30-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:5416a143-eb06-5a82-b78c-6f1b5e66e84f",
      "id": "CVE-2024-38808",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.30-tuxcare.1 of org.springframework:spring-messaging."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.30-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:4d27ab1d-3cc3-5732-b74b-965b698c7e22",
      "id": "CVE-2024-38809",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.30-tuxcare.1 of org.springframework:spring-messaging."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.30-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:0e70cf03-3930-5dd7-b1d3-0b3316395076",
      "id": "CVE-2024-38816",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.30-tuxcare.1 of org.springframework:spring-messaging."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.30-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:3f678586-99fe-5734-b6c4-f815ed4afa16",
      "id": "CVE-2024-38819",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.30-tuxcare.1 of org.springframework:spring-messaging."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.30-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:c7b4507d-6bef-5188-a8dc-306a612ac741",
      "id": "CVE-2024-38820",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.30-tuxcare.1 of org.springframework:spring-messaging."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.30-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:e9ab5e37-2bd2-555f-9869-d957f394db7c",
      "id": "CVE-2024-38828",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.30-tuxcare.1 of org.springframework:spring-messaging."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.30-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:7fe1cbab-6cf8-5238-b079-c083d6b13b1d",
      "id": "CVE-2025-22233",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.30-tuxcare.1 of org.springframework:spring-messaging."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.30-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:8bb0436a-b6f3-5f0c-bf98-d29b8d83f7b6",
      "id": "CVE-2025-41242",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.30-tuxcare.1 of org.springframework:spring-messaging."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.30-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:b86bcf76-ae88-57f1-a360-21e9b4a4744b",
      "id": "CVE-2025-41249",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.30-tuxcare.1 of org.springframework:spring-messaging."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.30-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:b9c4ff32-4ea4-5cd5-800b-16d5d799e506",
      "id": "CVE-2025-41254",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.30-tuxcare.1 of org.springframework:spring-messaging."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.30-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:cac6744d-809f-52c1-b817-8debe6596594",
      "id": "CVE-2026-22735",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-22735 affects version 5.3.30-tuxcare.1 of org.springframework:spring-messaging."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.30-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:c7f9585e-aff8-50e6-a3a0-ea134f556927",
      "id": "CVE-2026-22737",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-22737 affects version 5.3.30-tuxcare.1 of org.springframework:spring-messaging."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.30-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:241a4835-b3da-533d-bd9b-777189b0aa72",
      "id": "CVE-2026-22740",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-22740 affects version 5.3.30-tuxcare.1 of org.springframework:spring-messaging."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.30-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:081995c7-7dec-51dd-ba7d-3ce78ae26e46",
      "id": "CVE-2026-22741",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-22741 affects version 5.3.30-tuxcare.1 of org.springframework:spring-messaging."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.30-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:88cd0e18-119d-58b1-8b14-5107e98bd6b8",
      "id": "CVE-2026-22745",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-22745 affects version 5.3.30-tuxcare.1 of org.springframework:spring-messaging."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.30-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:9ffa4dca-c459-5627-8cc7-7a3c821b1f6c",
      "id": "CVE-2026-41838",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41838 affects version 5.3.30-tuxcare.1 of org.springframework:spring-messaging."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.30-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:f22887c8-4c8e-5abd-ad3a-1095f1a58f8f",
      "id": "CVE-2026-41839",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41839 affects version 5.3.30-tuxcare.1 of org.springframework:spring-messaging."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.30-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:73804cce-0446-55ce-80c5-83179b37f1c1",
      "id": "CVE-2026-41840",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.30-tuxcare.1 of org.springframework:spring-messaging. already_fixed \u2014 The target repository Spring Framework 5.3.30-tuxcare.3 already contains both fixes for CVE-2026-41840. The identical patches were previously backported by TuxCare as part of CVE-2026-22740 (commits 1a619adbfb and ee9443b0bc, merged May 2026). Both doOnDiscard handlers are present in the current code: PartGenerator.java releases data buffers on discard, and MultipartHttpMessageReader.java delet..."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.30-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:764beb3c-05f6-5ef0-af6c-8f6722f1f705",
      "id": "CVE-2026-41841",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41841 affects version 5.3.30-tuxcare.1 of org.springframework:spring-messaging."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.30-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:ed215bb4-30c6-52f5-a53f-70532f3fb52f",
      "id": "CVE-2026-41842",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41842 affects version 5.3.30-tuxcare.1 of org.springframework:spring-messaging."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.30-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:218dece3-7832-5d31-97db-a58f3de04db8",
      "id": "CVE-2026-41843",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41843 affects version 5.3.30-tuxcare.1 of org.springframework:spring-messaging."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.30-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:96e9288c-d3c2-5839-a010-64e347ce6734",
      "id": "CVE-2026-41844",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41844 affects version 5.3.30-tuxcare.1 of org.springframework:spring-messaging."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.30-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:9a7776dc-ea4a-5699-87a4-99908393aa93",
      "id": "CVE-2026-41845",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41845 affects version 5.3.30-tuxcare.1 of org.springframework:spring-messaging."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.30-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:5aa48d3a-3d79-5886-a4b8-841e8127a734",
      "id": "CVE-2026-41846",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41846 affects version 5.3.30-tuxcare.1 of org.springframework:spring-messaging."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.30-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:9c70ad56-074c-5acd-ad40-760fabaa2e0c",
      "id": "CVE-2026-41847",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41847 affects version 5.3.30-tuxcare.1 of org.springframework:spring-messaging."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.30-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:b3b9ea28-dc58-5c15-a0e2-d3471df0a3fd",
      "id": "CVE-2026-41848",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41848 affects version 5.3.30-tuxcare.1 of org.springframework:spring-messaging."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.30-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:54f09913-358f-56fc-88b4-0c44682d5a7a",
      "id": "CVE-2026-41849",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41849 affects version 5.3.30-tuxcare.1 of org.springframework:spring-messaging."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.30-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:79b44c6e-f06c-5bbe-b326-b91239c41980",
      "id": "CVE-2026-41850",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41850 affects version 5.3.30-tuxcare.1 of org.springframework:spring-messaging."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.30-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:58926a36-205d-5621-b604-b18d271d939e",
      "id": "CVE-2026-41851",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41851 affects version 5.3.30-tuxcare.1 of org.springframework:spring-messaging."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.30-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:8acac64d-1ac8-523b-8ff2-ff259768c50a",
      "id": "CVE-2026-41852",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41852 affects version 5.3.30-tuxcare.1 of org.springframework:spring-messaging."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.30-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:0047f394-4a56-56af-8137-ba3bdf0f5e6b",
      "id": "CVE-2026-41853",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41853 affects version 5.3.30-tuxcare.1 of org.springframework:spring-messaging."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.30-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:31466ee5-b93b-5acb-9fb3-b2ba858bb670",
      "id": "CVE-2026-41855",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41855 affects version 5.3.30-tuxcare.1 of org.springframework:spring-messaging."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.30-tuxcare.1"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@5.3.30-tuxcare.1"
    }
  ]
}