{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:acddde19-5c42-5c96-b6af-5dcbab832ea4",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.8",
      "type": "library",
      "group": "org.springframework",
      "name": "spring-test",
      "version": "5.3.37-tuxcare.8",
      "purl": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.8"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:5c37e750-6e4c-58c0-b843-e42510573417",
      "id": "CVE-2016-1000027",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.37-tuxcare.8 of org.springframework:spring-test."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:cccb1bf9-91c5-5714-8564-4b28cc825f45",
      "id": "CVE-2024-38808",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.37-tuxcare.8 of org.springframework:spring-test."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:4e07707a-a24b-5ba8-98de-dc0a437d430a",
      "id": "CVE-2024-38809",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.37-tuxcare.8 of org.springframework:spring-test."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d713b997-34c5-52ef-8927-dd16dc9b1097",
      "id": "CVE-2024-38816",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.37-tuxcare.8 of org.springframework:spring-test."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:ebafeb78-ca1d-5430-8c3f-ffe93996248a",
      "id": "CVE-2024-38819",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.37-tuxcare.8 of org.springframework:spring-test."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:2b55aef7-3785-5e82-ac80-f7ce5b1fb3ae",
      "id": "CVE-2024-38820",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.37-tuxcare.8 of org.springframework:spring-test."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:94f866be-d576-5ea1-8caa-0db720ed4b78",
      "id": "CVE-2024-38828",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.37-tuxcare.8 of org.springframework:spring-test."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:43a3431d-48b3-5187-b393-4ce31a0b0c9d",
      "id": "CVE-2025-22233",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.37-tuxcare.8 of org.springframework:spring-test."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:e918e24d-c8b6-5bf6-9fdc-a9c4d4286618",
      "id": "CVE-2025-41242",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-41242 affects version 5.3.37-tuxcare.8 of org.springframework:spring-test."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:9f8f0e23-ca18-571d-a0b8-849ed4c8816c",
      "id": "CVE-2025-41249",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.37-tuxcare.8 of org.springframework:spring-test."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:add0ea33-f122-5975-a131-7285c87968bf",
      "id": "CVE-2025-41254",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-41254 affects version 5.3.37-tuxcare.8 of org.springframework:spring-test."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:93a6bbca-799a-5210-aeef-bcc261b38e5e",
      "id": "CVE-2026-22735",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.37-tuxcare.8 of org.springframework:spring-test."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:f4f5cd6b-7252-5667-b369-bc096e68ec26",
      "id": "CVE-2026-22737",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.37-tuxcare.8 of org.springframework:spring-test."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:e9742acb-e427-5cc8-a39e-8986a2f3547e",
      "id": "CVE-2026-22740",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.37-tuxcare.8 of org.springframework:spring-test."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:ad877fd5-ccb4-5b0e-aa6a-d54bd0abc6f3",
      "id": "CVE-2026-22741",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.37-tuxcare.8 of org.springframework:spring-test."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:8934e7b9-2b25-56b0-acf3-4931f23b1469",
      "id": "CVE-2026-22745",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.37-tuxcare.8 of org.springframework:spring-test."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d3d802c8-6de8-5eff-aaa7-545b8b535ce1",
      "id": "CVE-2026-41838",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.37-tuxcare.8 of org.springframework:spring-test."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:4276fa7a-524f-54a9-9a6e-5b66bf0aee8a",
      "id": "CVE-2026-41839",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41839 affects version 5.3.37-tuxcare.8 of org.springframework:spring-test."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:5254a46c-7240-5acb-aff0-6ef352ef2a49",
      "id": "CVE-2026-41840",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.37-tuxcare.8 of org.springframework:spring-test. already_fixed \u2014 The target repository (Spring Framework 5.3.37-tuxcare.6) already contains both fixes for CVE-2026-41840. The fixes were backported on June 8, 2026 via commit 648b33d0a3 as part of CVE-2026-22740 remediation, which addresses the same multipart memory leak vulnerability."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:78383f71-2014-5229-8d3f-ce2f27a24c59",
      "id": "CVE-2026-41841",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41841 affects version 5.3.37-tuxcare.8 of org.springframework:spring-test."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:b26f508c-31a2-5253-9e01-d8609810c251",
      "id": "CVE-2026-41842",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41842 affects version 5.3.37-tuxcare.8 of org.springframework:spring-test."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:69ea2419-a03a-58ab-aa0f-c67bae9e779c",
      "id": "CVE-2026-41843",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41843 affects version 5.3.37-tuxcare.8 of org.springframework:spring-test."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:2f404327-94b4-5cd7-8413-e5e9a1082b42",
      "id": "CVE-2026-41844",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.37-tuxcare.8 of org.springframework:spring-test."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:8947471e-ba99-5816-9b96-6233861d3c7d",
      "id": "CVE-2026-41845",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.37-tuxcare.8 of org.springframework:spring-test."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:ba63d4a7-3e9e-5086-86df-24e409d8f732",
      "id": "CVE-2026-41846",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41846 affects version 5.3.37-tuxcare.8 of org.springframework:spring-test."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:214621a1-de55-5e5a-920d-d246dedc32bd",
      "id": "CVE-2026-41847",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41847 affects version 5.3.37-tuxcare.8 of org.springframework:spring-test."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:7ac20eb8-43f1-577a-abbd-6ba26328ba30",
      "id": "CVE-2026-41848",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41848 affects version 5.3.37-tuxcare.8 of org.springframework:spring-test."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:5db7d990-136c-59f4-8730-480d42765f2f",
      "id": "CVE-2026-41849",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41849 does not affect version 5.3.37-tuxcare.8 of org.springframework:spring-test. Already patched: all patch commits for CVE-2026-41849 already present in target branch (momus prerequisite AllPatchCommitsAlreadyInTarget)."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:737fc4ad-13a1-5c68-916e-ceea36510725",
      "id": "CVE-2026-41850",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41850 affects version 5.3.37-tuxcare.8 of org.springframework:spring-test."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:c3bf48d3-556f-51f0-8a88-e15dfd5a82d3",
      "id": "CVE-2026-41851",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41851 affects version 5.3.37-tuxcare.8 of org.springframework:spring-test."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:2e3dc7e6-1c5f-5a71-bc53-c75d8c0c0285",
      "id": "CVE-2026-41852",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41852 affects version 5.3.37-tuxcare.8 of org.springframework:spring-test."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:de4d10b2-820d-5c1b-abd9-eb066996f708",
      "id": "CVE-2026-41853",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41853 affects version 5.3.37-tuxcare.8 of org.springframework:spring-test."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:7e79e446-0884-57a2-b45e-3aee51efa2a4",
      "id": "CVE-2026-41855",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41855 affects version 5.3.37-tuxcare.8 of org.springframework:spring-test."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.8"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-test@5.3.37-tuxcare.8"
    }
  ]
}