{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:839b7504-6440-5de6-bb79-365b527d64ca",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.6",
      "type": "library",
      "group": "org.springframework",
      "name": "spring-orm",
      "version": "5.3.31-tuxcare.6",
      "purl": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.6"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:d9d8a916-b661-51fb-b6d0-374f53126d0d",
      "id": "CVE-2016-1000027",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.31-tuxcare.6 of org.springframework:spring-orm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:73ef32e9-357f-5acd-8de7-1df2fbca8c1c",
      "id": "CVE-2024-22243",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.31-tuxcare.6 of org.springframework:spring-orm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:c7e75424-87de-5832-8616-a6a8eb4a8a4e",
      "id": "CVE-2024-22259",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.31-tuxcare.6 of org.springframework:spring-orm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:7d0139da-509e-53dd-89e5-55988cf53bd1",
      "id": "CVE-2024-22262",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.31-tuxcare.6 of org.springframework:spring-orm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:57e1c571-dfe9-50f3-a6c7-dfac8bf6b47e",
      "id": "CVE-2024-38808",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.31-tuxcare.6 of org.springframework:spring-orm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:64c14a56-8e34-5eaf-98b9-b45e952e4f0e",
      "id": "CVE-2024-38809",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.31-tuxcare.6 of org.springframework:spring-orm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:6f0206be-a60b-5839-b500-56d25e153caf",
      "id": "CVE-2024-38816",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.31-tuxcare.6 of org.springframework:spring-orm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:53401a0e-6156-515a-8602-6435ef00cffd",
      "id": "CVE-2024-38819",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.31-tuxcare.6 of org.springframework:spring-orm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:e568d9a3-ebb1-526d-9d32-78d8b1999dbe",
      "id": "CVE-2024-38820",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.31-tuxcare.6 of org.springframework:spring-orm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:ac74c0dd-333c-5ad9-86e3-5eaff80ad87c",
      "id": "CVE-2024-38828",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.31-tuxcare.6 of org.springframework:spring-orm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:29dd7c34-9cc0-5200-a0ad-e628d4d7ec26",
      "id": "CVE-2025-22233",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.31-tuxcare.6 of org.springframework:spring-orm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:88ca73a3-ed29-5ef7-a26d-67ef448decf4",
      "id": "CVE-2025-41234",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring-orm 5.3.31-tuxcare.6."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:419980c4-bf83-5621-ac64-48520c56f699",
      "id": "CVE-2025-41242",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.31-tuxcare.6 of org.springframework:spring-orm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:34812142-797e-56f6-a93e-11cbdf0171d0",
      "id": "CVE-2025-41249",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.31-tuxcare.6 of org.springframework:spring-orm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:207473fd-e153-52e8-a483-dfb0a9148a0a",
      "id": "CVE-2025-41254",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.31-tuxcare.6 of org.springframework:spring-orm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:c9ee8832-e71c-5e0b-97cb-11a64f88283d",
      "id": "CVE-2026-22735",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.31-tuxcare.6 of org.springframework:spring-orm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:9a77e694-56fb-57b8-a944-f33260dba8e7",
      "id": "CVE-2026-22737",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.31-tuxcare.6 of org.springframework:spring-orm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:86391a5a-9c9d-5264-bd9c-572dc80df1c3",
      "id": "CVE-2026-22740",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.31-tuxcare.6 of org.springframework:spring-orm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:bd363414-fe3e-5dfd-9bce-f3aecd6b56ba",
      "id": "CVE-2026-22741",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-22741 affects version 5.3.31-tuxcare.6 of org.springframework:spring-orm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:75bb6cf8-733d-5e9f-8d5f-c21fb5af8977",
      "id": "CVE-2026-22745",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.31-tuxcare.6 of org.springframework:spring-orm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:e034d4f4-b184-51fe-bf82-194b96caa51f",
      "id": "CVE-2026-41838",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.31-tuxcare.6 of org.springframework:spring-orm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:4006f356-f93d-592c-8069-e7116c4cb368",
      "id": "CVE-2026-41839",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.31-tuxcare.6 of org.springframework:spring-orm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:835f1e06-0539-523b-b2fb-9bc8920caa31",
      "id": "CVE-2026-41840",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.31-tuxcare.6 of org.springframework:spring-orm. already_fixed \u2014 The target repository (Spring Framework 5.3.31-tuxcare.3) already contains the complete fix for CVE-2026-41840. Both required doOnDiscard handlers were applied via commit 615477c88f (labeled as CVE-2026-22740 backport) merged on May 4, 2026. The code changes are byte-for-byte identical to the upstream patches."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:f58d0461-ee98-5cc5-bc4d-7fea21e89f72",
      "id": "CVE-2026-41841",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41841 affects version 5.3.31-tuxcare.6 of org.springframework:spring-orm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:15893e2f-4da7-5eb9-afa1-2c74f06f568c",
      "id": "CVE-2026-41842",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41842 affects version 5.3.31-tuxcare.6 of org.springframework:spring-orm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:32d616f2-fe27-52d8-87bf-736dce856c0c",
      "id": "CVE-2026-41843",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41843 affects version 5.3.31-tuxcare.6 of org.springframework:spring-orm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:f58d663b-a3e8-50d2-a047-d8f1de67cd6f",
      "id": "CVE-2026-41844",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.31-tuxcare.6 of org.springframework:spring-orm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:c08b1ba9-ef22-51fc-be35-f544256139e4",
      "id": "CVE-2026-41845",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.31-tuxcare.6 of org.springframework:spring-orm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:f30799ed-f85e-5ba2-921d-78084b434b95",
      "id": "CVE-2026-41846",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41846 affects version 5.3.31-tuxcare.6 of org.springframework:spring-orm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:5a227361-cc74-571d-9dbc-344cb3dda3de",
      "id": "CVE-2026-41847",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41847 affects version 5.3.31-tuxcare.6 of org.springframework:spring-orm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:92751317-9726-5661-aa3e-26a9419b81ec",
      "id": "CVE-2026-41848",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41848 affects version 5.3.31-tuxcare.6 of org.springframework:spring-orm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:1c07793d-21f7-5dbc-a97c-26401406633a",
      "id": "CVE-2026-41849",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41849 affects version 5.3.31-tuxcare.6 of org.springframework:spring-orm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:776e7e81-1d3a-57e7-af0b-022a646eba74",
      "id": "CVE-2026-41850",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41850 affects version 5.3.31-tuxcare.6 of org.springframework:spring-orm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:dab31d2e-0710-5e36-919f-4917bd3bcc35",
      "id": "CVE-2026-41851",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41851 affects version 5.3.31-tuxcare.6 of org.springframework:spring-orm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:e50758a0-00f4-581e-ac30-9039feb44054",
      "id": "CVE-2026-41852",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41852 affects version 5.3.31-tuxcare.6 of org.springframework:spring-orm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:b9b8177b-858b-56ea-b3e7-5c0fccfeab3f",
      "id": "CVE-2026-41853",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.31-tuxcare.6 of org.springframework:spring-orm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:120ed228-0a22-543d-86b7-8a5777c195af",
      "id": "CVE-2026-41855",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41855 affects version 5.3.31-tuxcare.6 of org.springframework:spring-orm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.6"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.6"
    }
  ]
}