{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:fa22fb70-9bcf-57e4-b42d-0145c8fe021c",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.7",
      "type": "library",
      "group": "org.springframework",
      "name": "spring-r2dbc",
      "version": "5.3.31-tuxcare.7",
      "purl": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.7"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:7671f39f-f0df-5f67-9704-1009e62e531d",
      "id": "CVE-2016-1000027",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.31-tuxcare.7 of org.springframework:spring-r2dbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.7"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:e8436c97-b629-53d7-ac65-0e76922dd6ab",
      "id": "CVE-2024-22243",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.31-tuxcare.7 of org.springframework:spring-r2dbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.7"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:a9ac536b-af88-558b-8096-59b4db189f96",
      "id": "CVE-2024-22259",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.31-tuxcare.7 of org.springframework:spring-r2dbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.7"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:631151b7-632b-5972-8bc3-38bceeda3a21",
      "id": "CVE-2024-22262",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.31-tuxcare.7 of org.springframework:spring-r2dbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.7"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:a7d22998-a7b8-5e08-a8e7-72ec1c1abffd",
      "id": "CVE-2024-38808",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.31-tuxcare.7 of org.springframework:spring-r2dbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.7"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d190ebaf-39c2-516e-996a-534ce7fdb926",
      "id": "CVE-2024-38809",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.31-tuxcare.7 of org.springframework:spring-r2dbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.7"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:33e36122-9a7b-5ea1-bc18-fb2adab792ab",
      "id": "CVE-2024-38816",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.31-tuxcare.7 of org.springframework:spring-r2dbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.7"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:5270d603-2fef-53c7-9296-ad364dd2cc0d",
      "id": "CVE-2024-38819",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.31-tuxcare.7 of org.springframework:spring-r2dbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.7"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:a1439d04-8877-5adf-b0a7-a23146772593",
      "id": "CVE-2024-38820",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.31-tuxcare.7 of org.springframework:spring-r2dbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.7"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:5257e62e-08c6-5b5a-b89f-b7223c1a590e",
      "id": "CVE-2024-38828",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.31-tuxcare.7 of org.springframework:spring-r2dbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.7"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:e1358abb-9d30-5f70-843a-ec3e9b64e3f2",
      "id": "CVE-2025-22233",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.31-tuxcare.7 of org.springframework:spring-r2dbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.7"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:ff1b9342-eaef-58d4-9943-25e781e0bca4",
      "id": "CVE-2025-41234",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring-r2dbc 5.3.31-tuxcare.7."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.7"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:58b7f33e-91a1-5131-856b-96a4903f3055",
      "id": "CVE-2025-41242",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.31-tuxcare.7 of org.springframework:spring-r2dbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.7"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:4c87fbeb-b158-560b-9365-888712d84801",
      "id": "CVE-2025-41249",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.31-tuxcare.7 of org.springframework:spring-r2dbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.7"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:371710c0-2c48-5dbb-a985-3dc9f50d4183",
      "id": "CVE-2025-41254",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.31-tuxcare.7 of org.springframework:spring-r2dbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.7"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:ae485905-2274-502d-9887-9c147ac876ea",
      "id": "CVE-2026-22735",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.31-tuxcare.7 of org.springframework:spring-r2dbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.7"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:2b9532ac-28c1-5147-957d-be7c4e71710e",
      "id": "CVE-2026-22737",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.31-tuxcare.7 of org.springframework:spring-r2dbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.7"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:7b5ac153-75c3-5d79-841a-ff68598bad9a",
      "id": "CVE-2026-22740",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.31-tuxcare.7 of org.springframework:spring-r2dbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.7"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:4ef18fea-0b10-5d3a-8596-c805820def52",
      "id": "CVE-2026-22741",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-22741 affects version 5.3.31-tuxcare.7 of org.springframework:spring-r2dbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.7"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:921380ca-cb1e-54ec-9cf0-1551efa2e792",
      "id": "CVE-2026-22745",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.31-tuxcare.7 of org.springframework:spring-r2dbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.7"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:9fd8219d-4a77-5295-8b02-a7ab60bf8f62",
      "id": "CVE-2026-41838",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.31-tuxcare.7 of org.springframework:spring-r2dbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.7"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:ad09fc63-7171-5b1f-90f9-e9649a756964",
      "id": "CVE-2026-41839",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.31-tuxcare.7 of org.springframework:spring-r2dbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.7"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:ac072f05-a0b0-5eee-a403-ec95b636077b",
      "id": "CVE-2026-41840",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.31-tuxcare.7 of org.springframework:spring-r2dbc. already_fixed \u2014 The target repository (Spring Framework 5.3.31-tuxcare.3) already contains the complete fix for CVE-2026-41840. Both required doOnDiscard handlers were applied via commit 615477c88f (labeled as CVE-2026-22740 backport) merged on May 4, 2026. The code changes are byte-for-byte identical to the upstream patches."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.7"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:ace7e533-ccbb-53c6-ae99-4090c64b1297",
      "id": "CVE-2026-41841",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41841 affects version 5.3.31-tuxcare.7 of org.springframework:spring-r2dbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.7"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:7ff049f8-ddc6-5a7f-8027-a140d11164bc",
      "id": "CVE-2026-41842",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41842 affects version 5.3.31-tuxcare.7 of org.springframework:spring-r2dbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.7"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:1701f446-89eb-5ed0-adc4-328f460a7a44",
      "id": "CVE-2026-41843",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41843 affects version 5.3.31-tuxcare.7 of org.springframework:spring-r2dbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.7"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:54112525-ddf7-5ad2-82e8-e783ffd376e9",
      "id": "CVE-2026-41844",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.31-tuxcare.7 of org.springframework:spring-r2dbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.7"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:fb846e0f-e009-5b54-a68c-d2f04bcf5505",
      "id": "CVE-2026-41845",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.31-tuxcare.7 of org.springframework:spring-r2dbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.7"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:f09626a2-5319-53d3-a5aa-76847cb29426",
      "id": "CVE-2026-41846",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41846 affects version 5.3.31-tuxcare.7 of org.springframework:spring-r2dbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.7"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:22cdd469-65b2-50dc-8bbf-18d01ff8f19f",
      "id": "CVE-2026-41847",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41847 affects version 5.3.31-tuxcare.7 of org.springframework:spring-r2dbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.7"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:08dea199-3bb3-5f63-93c3-fffb79b4435b",
      "id": "CVE-2026-41848",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.31-tuxcare.7 of org.springframework:spring-r2dbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.7"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:8a6d902a-9ec3-5426-8496-1315b97678bf",
      "id": "CVE-2026-41849",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41849 affects version 5.3.31-tuxcare.7 of org.springframework:spring-r2dbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.7"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:1d67fdab-05a3-573c-a7f4-1501dc756833",
      "id": "CVE-2026-41850",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41850 affects version 5.3.31-tuxcare.7 of org.springframework:spring-r2dbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.7"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:6db26243-eb9d-5586-a74a-4eabf4b89ef0",
      "id": "CVE-2026-41851",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41851 affects version 5.3.31-tuxcare.7 of org.springframework:spring-r2dbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.7"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:783d77ac-808c-5270-8e48-8ba027b28ab6",
      "id": "CVE-2026-41852",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41852 affects version 5.3.31-tuxcare.7 of org.springframework:spring-r2dbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.7"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:4b1933b9-3723-5229-844e-b098820ff287",
      "id": "CVE-2026-41853",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.31-tuxcare.7 of org.springframework:spring-r2dbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.7"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:8568fe3e-50f5-5b9e-a548-c0f62b7079df",
      "id": "CVE-2026-41855",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.31-tuxcare.7 of org.springframework:spring-r2dbc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.7"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-r2dbc@5.3.31-tuxcare.7"
    }
  ]
}