{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:bec87017-350b-5538-a3f2-c48d47d75f49",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@5.3.39-tuxcare.17",
      "type": "library",
      "group": "org.springframework",
      "name": "spring-messaging",
      "version": "5.3.39-tuxcare.17",
      "purl": "pkg:maven/org.springframework/spring-messaging@5.3.39-tuxcare.17"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:f67497b6-0ddf-5086-860d-a5315f343a2c",
      "id": "CVE-2016-1000027",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.39-tuxcare.17 of org.springframework:spring-messaging."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.39-tuxcare.17"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:a696bab5-4e29-5f76-929d-864419bda1fa",
      "id": "CVE-2022-22968",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22968 does not affect version 5.3.39-tuxcare.17 of org.springframework:spring-messaging. Spring version 5.3.39 is not affected to CVE-2022-22968 as fix has been already already backported by the original developers"
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.39-tuxcare.17"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:08079ec9-f454-5e95-8011-862bfd7a46e4",
      "id": "CVE-2024-38816",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-messaging."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.39-tuxcare.17"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:9c6e543c-00d6-5cda-b6cb-b1a5642bec0c",
      "id": "CVE-2024-38819",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-messaging."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.39-tuxcare.17"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:54152dac-36ef-5184-9d04-326d08ec222e",
      "id": "CVE-2024-38820",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-messaging."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.39-tuxcare.17"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:b5d7f4ec-b952-5758-a070-8857b4449b1d",
      "id": "CVE-2024-38828",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-messaging."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.39-tuxcare.17"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:c1e28c1b-375a-54fe-97b7-03b1e8b9d169",
      "id": "CVE-2025-22233",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-messaging."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.39-tuxcare.17"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:fda6fdac-dc1e-5c97-b8d8-e7d98991bb45",
      "id": "CVE-2025-41234",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring-messaging 5.3.39-tuxcare.17."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.39-tuxcare.17"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:b482e73e-312e-5acc-804a-b1048d2d8965",
      "id": "CVE-2025-41242",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-messaging."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.39-tuxcare.17"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:af0f8a65-6c8f-5baf-a233-a1e7be250839",
      "id": "CVE-2025-41249",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-messaging."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.39-tuxcare.17"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:75a9c4a9-7675-5911-8bc3-802e417e844d",
      "id": "CVE-2025-41254",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-messaging."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.39-tuxcare.17"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:a0dc686c-abe8-5c8f-b1ef-883aef4313e7",
      "id": "CVE-2026-22735",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-messaging."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.39-tuxcare.17"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:163946cb-4d27-571b-8931-18e78dc7a999",
      "id": "CVE-2026-22737",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-messaging."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.39-tuxcare.17"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:01efe101-f993-5685-b2dd-1d44c3d08474",
      "id": "CVE-2026-22740",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-messaging."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.39-tuxcare.17"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:5647f4ff-c302-5c7d-9af0-744a506b250d",
      "id": "CVE-2026-22741",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-messaging."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.39-tuxcare.17"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:687319e3-4620-542f-a0d4-b6289d970e94",
      "id": "CVE-2026-22745",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-messaging."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.39-tuxcare.17"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:312f07be-3844-531c-92e4-43e6290dcf95",
      "id": "CVE-2026-41838",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-messaging."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.39-tuxcare.17"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:0fcb87a0-022c-598c-8d42-96fa2bb3078b",
      "id": "CVE-2026-41839",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-messaging."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.39-tuxcare.17"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:09ba7219-7944-5d40-9c6a-6b142001b923",
      "id": "CVE-2026-41840",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.39-tuxcare.17 of org.springframework:spring-messaging. already_fixed \u2014 The target Spring Framework 5.3.39-tuxcare.12 already contains both vendor fixes for CVE-2026-41840. The fixes were backported via commit 4ef4cdca34 (May 13, 2026) under CVE-2026-22740, but the code changes are identical to the upstream patches. Both doOnDiscard handlers are present and active in PartGenerator.java and MultipartHttpMessageReader.java, preventing memory exhaustion from unrelease..."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.39-tuxcare.17"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:efe482b4-8ab6-5648-99f5-3392099377fd",
      "id": "CVE-2026-41841",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41841 affects version 5.3.39-tuxcare.17 of org.springframework:spring-messaging."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.39-tuxcare.17"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:78a32514-632d-5c78-af26-dad0ddb0502d",
      "id": "CVE-2026-41842",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-messaging."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.39-tuxcare.17"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:c43a3136-1967-5475-af68-d0a3ac615955",
      "id": "CVE-2026-41843",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41843 affects version 5.3.39-tuxcare.17 of org.springframework:spring-messaging."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.39-tuxcare.17"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:3c6dbe6c-6635-57a1-8ce2-e86fb2b31f97",
      "id": "CVE-2026-41844",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-messaging."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.39-tuxcare.17"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:531eebe3-f30b-5617-9fac-d8f2ab695c68",
      "id": "CVE-2026-41845",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-messaging."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.39-tuxcare.17"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:13012590-17db-55dd-97f0-b21308041b8d",
      "id": "CVE-2026-41846",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-messaging."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.39-tuxcare.17"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:155d8afb-a102-59a3-a9c6-200e6c7867db",
      "id": "CVE-2026-41847",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-messaging."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.39-tuxcare.17"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:f6493675-177b-5d67-8713-ab53eb4d8863",
      "id": "CVE-2026-41848",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-messaging."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.39-tuxcare.17"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:deb9b526-412d-525c-9c10-142966eb131f",
      "id": "CVE-2026-41849",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-messaging."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.39-tuxcare.17"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:11088938-3f7b-5068-9256-2f1b586bcdaf",
      "id": "CVE-2026-41850",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-messaging."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.39-tuxcare.17"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:4e266ff4-f81d-5cda-a4cc-46b475015e00",
      "id": "CVE-2026-41851",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41851 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-messaging."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.39-tuxcare.17"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:4ced8dea-b11e-53d8-bd47-15c7cfcde5a2",
      "id": "CVE-2026-41852",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-messaging."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.39-tuxcare.17"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:e35b163b-27ed-5749-9ad9-4b2ba94f0b9b",
      "id": "CVE-2026-41853",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-messaging."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.39-tuxcare.17"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:77aed41d-46ab-554d-9e86-09123ebf0127",
      "id": "CVE-2026-41855",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-messaging."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.39-tuxcare.17"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@5.3.39-tuxcare.17"
    }
  ]
}