{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:786a0fd7-4278-59fc-9e5e-2c0025f1f1b0",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.9",
      "type": "library",
      "group": "org.springframework",
      "name": "spring-orm",
      "version": "5.3.31-tuxcare.9",
      "purl": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.9"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:7d8ed233-6d7a-5b82-85cb-9069a641e5d1",
      "id": "CVE-2016-1000027",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.31-tuxcare.9 of org.springframework:spring-orm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:6ba09395-b7f7-573d-b6bd-4148a0229e1b",
      "id": "CVE-2024-22243",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring-orm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:5f1fd345-da83-5c8f-86a9-1d73b73cc201",
      "id": "CVE-2024-22259",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring-orm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:b35c15da-a7d7-5c44-9dc4-8da8421bf6c1",
      "id": "CVE-2024-22262",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring-orm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:0327f4bf-9567-5122-afc9-31c11a9ac4e6",
      "id": "CVE-2024-38808",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring-orm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:aa38597a-9637-5b73-846d-6d58c3bf1fa0",
      "id": "CVE-2024-38809",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring-orm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:146ada03-1df1-5a46-a8d6-402af7584879",
      "id": "CVE-2024-38816",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring-orm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:1ddc06ad-e7fa-5eeb-84dc-20210ff6d885",
      "id": "CVE-2024-38819",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring-orm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:aab9cf42-34db-5135-b810-fe21d02efeaa",
      "id": "CVE-2024-38820",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring-orm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:33a40f5f-56db-5ee4-b5c9-de0f52d24484",
      "id": "CVE-2024-38828",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring-orm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:937f5192-c90a-5c78-b0a3-3cdd067d6f66",
      "id": "CVE-2025-22233",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring-orm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:e90d504d-8bdf-52b3-aa13-0c816a68d537",
      "id": "CVE-2025-41234",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring-orm 5.3.31-tuxcare.9."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:bf7a96fd-077f-54d3-a145-486a8ac6279f",
      "id": "CVE-2025-41242",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring-orm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:208616b8-4961-561e-a435-0fdc19196cc2",
      "id": "CVE-2025-41249",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring-orm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:cad6467c-295b-513a-a0ca-4ff9623a6df0",
      "id": "CVE-2025-41254",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring-orm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:3fe5e541-bd05-5037-8934-1092bcd0c8eb",
      "id": "CVE-2026-22735",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring-orm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:a81629f5-33be-5827-8ed8-fd6046b0c8d6",
      "id": "CVE-2026-22737",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring-orm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:09d1123c-1ab8-5d56-83e1-e267777c92d7",
      "id": "CVE-2026-22740",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring-orm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:544f9fc3-ea69-5531-9942-beb43f62cd7d",
      "id": "CVE-2026-22741",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring-orm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:2e9a3372-6498-5d51-8aea-1d58c62c4032",
      "id": "CVE-2026-22745",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring-orm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:9cba57dc-4cc1-50ea-85d4-7753faa524b7",
      "id": "CVE-2026-41838",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring-orm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:669ac187-6c03-5e7f-9cd3-ff6aa60be393",
      "id": "CVE-2026-41839",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring-orm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:bb9fc76b-c71d-505a-88b2-02e04ac7005b",
      "id": "CVE-2026-41840",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.31-tuxcare.9 of org.springframework:spring-orm. already_fixed \u2014 The target repository (Spring Framework 5.3.31-tuxcare.3) already contains the complete fix for CVE-2026-41840. Both required doOnDiscard handlers were applied via commit 615477c88f (labeled as CVE-2026-22740 backport) merged on May 4, 2026. The code changes are byte-for-byte identical to the upstream patches."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:58b9d27d-1eb0-5faa-87ac-96393978ce9b",
      "id": "CVE-2026-41841",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41841 affects version 5.3.31-tuxcare.9 of org.springframework:spring-orm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:f06feb68-f900-59e1-bed1-fb2fe959eec2",
      "id": "CVE-2026-41842",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41842 affects version 5.3.31-tuxcare.9 of org.springframework:spring-orm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:89d71147-2542-5c55-8fa3-933ad3aa2470",
      "id": "CVE-2026-41843",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41843 affects version 5.3.31-tuxcare.9 of org.springframework:spring-orm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:bc34089b-510c-5b6f-a3dd-7e4a0d8d4ba2",
      "id": "CVE-2026-41844",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring-orm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:b15fab29-9091-5183-b1d9-6edaa1f05da9",
      "id": "CVE-2026-41845",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring-orm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:6e9849db-e99e-5732-82e7-f75214a0427d",
      "id": "CVE-2026-41846",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring-orm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:090709ce-7ed2-5af7-a3d8-d9d8814636db",
      "id": "CVE-2026-41847",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41847 affects version 5.3.31-tuxcare.9 of org.springframework:spring-orm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:b6d5407c-f92f-5e34-a97e-c04d432b171d",
      "id": "CVE-2026-41848",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring-orm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:eba04e55-6f44-5e25-8307-1cdee5aa819d",
      "id": "CVE-2026-41849",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring-orm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:37466081-fdba-5c41-a887-16246a9f170c",
      "id": "CVE-2026-41850",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41850 affects version 5.3.31-tuxcare.9 of org.springframework:spring-orm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:2031ab25-5690-556d-a806-241be9529493",
      "id": "CVE-2026-41851",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41851 affects version 5.3.31-tuxcare.9 of org.springframework:spring-orm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:53c8ef6b-e08a-5c80-8fe8-24c7732c9f1d",
      "id": "CVE-2026-41852",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41852 affects version 5.3.31-tuxcare.9 of org.springframework:spring-orm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:4321870d-ab7d-5e2b-9a2c-73f5507fed39",
      "id": "CVE-2026-41853",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring-orm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:96ec997e-371e-52f1-9fbf-639a5d965d37",
      "id": "CVE-2026-41855",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring-orm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.9"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-orm@5.3.31-tuxcare.9"
    }
  ]
}