{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:147a85ea-7df9-5945-8876-166cba66200b",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.9",
      "type": "library",
      "group": "org.springframework",
      "name": "spring-oxm",
      "version": "5.3.31-tuxcare.9",
      "purl": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.9"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:a942d9d5-34c2-511b-b383-44e520693390",
      "id": "CVE-2016-1000027",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.31-tuxcare.9 of org.springframework:spring-oxm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:e8acfafc-0396-570e-9602-e5667c71c910",
      "id": "CVE-2024-22243",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring-oxm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:09d248b7-24a3-5858-8d33-a294f7b40d42",
      "id": "CVE-2024-22259",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring-oxm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:dcc01f92-1141-5e9e-9a24-0f6e90f0b09b",
      "id": "CVE-2024-22262",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring-oxm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:98be2de7-a54a-5738-965d-5653974a53ff",
      "id": "CVE-2024-38808",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring-oxm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:70853aea-1d55-5ed7-a090-6df5f2dcb030",
      "id": "CVE-2024-38809",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring-oxm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:25439217-6617-5de3-8ee8-bf5119046eea",
      "id": "CVE-2024-38816",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring-oxm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:07b4c5e6-9dc9-59a2-8c4d-172ccff5e66f",
      "id": "CVE-2024-38819",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring-oxm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:cee6fb88-3729-5f81-9208-d2cd7dbd37dc",
      "id": "CVE-2024-38820",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring-oxm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:408986d5-4a07-51c3-9275-87673a04501a",
      "id": "CVE-2024-38828",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring-oxm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:9bec2b4f-c159-5c9b-91c5-3bdc2f925c39",
      "id": "CVE-2025-22233",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring-oxm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:49667f21-ecfc-5d7e-b057-7770a161fa18",
      "id": "CVE-2025-41234",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring-oxm 5.3.31-tuxcare.9."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:03f1f41d-6fb5-5f97-a459-bbdd09f6d7ad",
      "id": "CVE-2025-41242",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring-oxm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:3ae9c4cc-34d6-57b2-9dca-0f8d5cba983b",
      "id": "CVE-2025-41249",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring-oxm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d3308887-e6d1-5b05-8276-6eee349d1799",
      "id": "CVE-2025-41254",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring-oxm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:7e7d8e5d-00e2-50ff-8a6b-fe426b0ac45e",
      "id": "CVE-2026-22735",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring-oxm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:ecb73c05-e539-5301-8f24-17e88ee2428c",
      "id": "CVE-2026-22737",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring-oxm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:fdaeb578-1588-535d-add2-8d7ab624d202",
      "id": "CVE-2026-22740",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring-oxm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:f40d4298-65ec-5aea-8dbe-84fbf65dc61c",
      "id": "CVE-2026-22741",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring-oxm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:8cff1b49-897b-507f-b117-f2fe65f36db1",
      "id": "CVE-2026-22745",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring-oxm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:b31f2626-d6ff-5fca-a858-d131e35e7a06",
      "id": "CVE-2026-41838",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring-oxm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:54322906-44e2-568a-b6d3-a7305d24c219",
      "id": "CVE-2026-41839",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring-oxm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:225f29da-a92c-51ab-b93b-9a8927c73f26",
      "id": "CVE-2026-41840",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.31-tuxcare.9 of org.springframework:spring-oxm. already_fixed \u2014 The target repository (Spring Framework 5.3.31-tuxcare.3) already contains the complete fix for CVE-2026-41840. Both required doOnDiscard handlers were applied via commit 615477c88f (labeled as CVE-2026-22740 backport) merged on May 4, 2026. The code changes are byte-for-byte identical to the upstream patches."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:a439c6fa-def8-5b79-a682-8d85d19302b7",
      "id": "CVE-2026-41841",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41841 affects version 5.3.31-tuxcare.9 of org.springframework:spring-oxm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:2029c08b-5140-5adb-ae79-81c8f320d855",
      "id": "CVE-2026-41842",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41842 affects version 5.3.31-tuxcare.9 of org.springframework:spring-oxm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:52b1c25e-9c1e-5e9b-bd0d-cfe3daab047b",
      "id": "CVE-2026-41843",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41843 affects version 5.3.31-tuxcare.9 of org.springframework:spring-oxm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:a508f7a4-7055-512a-b181-190b25ed4f0b",
      "id": "CVE-2026-41844",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring-oxm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:7e7868e2-904f-5c14-84f2-10f22795b21f",
      "id": "CVE-2026-41845",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring-oxm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:fc798c36-4d62-5dde-ac7d-14ff5ad9d389",
      "id": "CVE-2026-41846",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring-oxm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:99746295-f7c1-52b5-86f3-a6052084e968",
      "id": "CVE-2026-41847",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41847 affects version 5.3.31-tuxcare.9 of org.springframework:spring-oxm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:8d1601c5-b88a-53f7-bbe8-b652e0775796",
      "id": "CVE-2026-41848",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring-oxm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:235be586-a295-551a-a06d-8fc099b65714",
      "id": "CVE-2026-41849",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring-oxm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:547e12cc-59c8-5c43-981c-96adaf9b8291",
      "id": "CVE-2026-41850",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41850 affects version 5.3.31-tuxcare.9 of org.springframework:spring-oxm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:1a67ebf5-2027-5faf-a22a-0139bf6cda1b",
      "id": "CVE-2026-41851",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41851 affects version 5.3.31-tuxcare.9 of org.springframework:spring-oxm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:015d6e66-7837-5eb6-b3db-d8840bb7845f",
      "id": "CVE-2026-41852",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41852 affects version 5.3.31-tuxcare.9 of org.springframework:spring-oxm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:a7420079-7877-508e-8f4e-178b59803b41",
      "id": "CVE-2026-41853",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring-oxm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:ec28b257-fc0f-50a8-887c-6c2e90e1d6e2",
      "id": "CVE-2026-41855",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring-oxm."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.9"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-oxm@5.3.31-tuxcare.9"
    }
  ]
}