{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:7ce56ec7-194c-50cd-ae62-036427306eb9",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:maven/org.springframework/spring-web@5.3.27-tuxcare.6",
      "type": "library",
      "group": "org.springframework",
      "name": "spring-web",
      "version": "5.3.27-tuxcare.6",
      "purl": "pkg:maven/org.springframework/spring-web@5.3.27-tuxcare.6"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:e0a31499-9091-5232-84d3-3eb676cdfa17",
      "id": "CVE-2016-1000027",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.27-tuxcare.6 of org.springframework:spring-web."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.27-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:60bed38b-a9f8-5acb-985a-d6d4eb31f842",
      "id": "CVE-2024-22243",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-web."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.27-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:cb57d6fb-1db5-590b-bd9c-1782cde2f6bc",
      "id": "CVE-2024-22259",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-web."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.27-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:ba5a653b-4578-5010-8279-26cace20bfad",
      "id": "CVE-2024-22262",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-web."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.27-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:ec3a74e7-51c1-5b63-9777-fe6f9d83b02d",
      "id": "CVE-2024-38808",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-web."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.27-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:ce5f10a7-222c-507a-87c8-0812594f5147",
      "id": "CVE-2024-38809",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-web."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.27-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:5c059a85-5fc3-52b3-899c-dd210a87b4bc",
      "id": "CVE-2024-38816",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-web."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.27-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:b89c1ad6-932b-5b34-a549-b8ed9c5429be",
      "id": "CVE-2024-38819",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-web."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.27-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:cbc61711-960d-58fe-8b8e-778946f8d599",
      "id": "CVE-2024-38820",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-web."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.27-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:db7308c0-f582-5dee-a63a-393119e55b1d",
      "id": "CVE-2024-38828",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-web."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.27-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:a409ec55-9357-5836-af33-4308d4765556",
      "id": "CVE-2025-22233",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-web."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.27-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:e4e6405e-b2f7-56e9-92cf-0929c10761e8",
      "id": "CVE-2025-41234",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring-web 5.3.27-tuxcare.6."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.27-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:926c52e1-eac4-5401-9b23-f8fa5a20f228",
      "id": "CVE-2025-41242",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-web."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.27-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:0f66387d-98f8-58ee-8fe0-d3615e43b250",
      "id": "CVE-2025-41249",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-web."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.27-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:ecad1207-8aee-5987-b4bd-b72dcdb07ec6",
      "id": "CVE-2025-41254",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-web."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.27-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:ffef72c2-f6a4-547a-b8e0-38ca6a565d8f",
      "id": "CVE-2026-22735",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-web."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.27-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:453e01b4-61bb-58ac-85cf-c1575d3fba84",
      "id": "CVE-2026-22737",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-web."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.27-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:fb1ee76f-178c-580c-a535-643db353c223",
      "id": "CVE-2026-22740",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-web."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.27-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:a77fe725-f70b-5509-a1f3-9937f6878671",
      "id": "CVE-2026-22741",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-web."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.27-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:9bf2f59f-c168-5865-84dd-37dcfe25e63c",
      "id": "CVE-2026-22745",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-web."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.27-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:fa02c931-5fa8-5bc4-aa12-4c3fadec8b56",
      "id": "CVE-2026-41838",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-web."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.27-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:c1814740-823d-5c5b-a02e-38058f76eca9",
      "id": "CVE-2026-41839",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-web."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.27-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:5dddb73f-77d6-589f-b482-c2f2f53f5de6",
      "id": "CVE-2026-41840",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.27-tuxcare.6 of org.springframework:spring-web. already_fixed \u2014 The target repository (Spring Framework 5.3.27-tuxcare.5) already contains the fix for CVE-2026-41840. The vulnerability was previously addressed through backport commits for CVE-2026-22740, which applied the identical doOnDiscard cleanup logic to prevent resource exhaustion from multipart request processing."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.27-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:ec186215-03ea-5bc1-ac83-2563808c846d",
      "id": "CVE-2026-41841",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41841 affects version 5.3.27-tuxcare.6 of org.springframework:spring-web."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.27-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:a2441c65-1b89-5c07-9f05-926cf61886f0",
      "id": "CVE-2026-41842",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41842 affects version 5.3.27-tuxcare.6 of org.springframework:spring-web."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.27-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:2917c1ed-3b90-5481-a674-ddbeeefd3c10",
      "id": "CVE-2026-41843",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41843 affects version 5.3.27-tuxcare.6 of org.springframework:spring-web."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.27-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:6a2e6890-75aa-5f92-991a-705288e158eb",
      "id": "CVE-2026-41844",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-web."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.27-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:c4eb2635-942d-537d-984d-6ba3dd449564",
      "id": "CVE-2026-41845",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-web."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.27-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:3012bb20-883f-59a5-802f-c2c4db9b204c",
      "id": "CVE-2026-41846",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-web."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.27-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:51fdd462-e2fc-53f4-aae0-b3d9ee357692",
      "id": "CVE-2026-41847",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41847 does not affect version 5.3.27-tuxcare.6 of org.springframework:spring-web. All 1 patch commits already exist in target branch"
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.27-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:9c9ca0dc-f048-5aee-a684-f71f7372961b",
      "id": "CVE-2026-41848",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41848 affects version 5.3.27-tuxcare.6 of org.springframework:spring-web."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.27-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:04f6a719-4715-543f-b224-bdd76d2adc00",
      "id": "CVE-2026-41849",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41849 affects version 5.3.27-tuxcare.6 of org.springframework:spring-web."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.27-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:8909ae0d-a826-5a14-b285-878eb377d7fa",
      "id": "CVE-2026-41850",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41850 affects version 5.3.27-tuxcare.6 of org.springframework:spring-web."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.27-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:44b63019-d947-5759-9b08-0b452f4a8f75",
      "id": "CVE-2026-41851",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41851 affects version 5.3.27-tuxcare.6 of org.springframework:spring-web."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.27-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:874dbcd6-0d6f-51f9-a5c5-a72f52b7eeb3",
      "id": "CVE-2026-41852",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41852 affects version 5.3.27-tuxcare.6 of org.springframework:spring-web."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.27-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:a273b225-7ed6-5799-ae97-8ce42b36d77d",
      "id": "CVE-2026-41853",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-web."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.27-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:2e2e18f8-9d6c-5602-94f3-5c47b6fd0e59",
      "id": "CVE-2026-41855",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41855 affects version 5.3.27-tuxcare.6 of org.springframework:spring-web."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.27-tuxcare.6"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-web@5.3.27-tuxcare.6"
    }
  ]
}