{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:07c4df18-9c2d-5323-9a73-43ea8966cd7b",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.7",
      "type": "library",
      "group": "org.springframework",
      "name": "spring-web",
      "version": "5.3.31-tuxcare.7",
      "purl": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.7"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:af275065-b538-5b7c-8414-739adf183bd9",
      "id": "CVE-2016-1000027",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.31-tuxcare.7 of org.springframework:spring-web."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.7"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:068b720c-f5fe-5b19-8352-f2a3abd2ad8e",
      "id": "CVE-2024-22243",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.31-tuxcare.7 of org.springframework:spring-web."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.7"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:6ee024d9-898a-5f32-9be5-c4f0a343e458",
      "id": "CVE-2024-22259",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.31-tuxcare.7 of org.springframework:spring-web."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.7"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d64975a3-57dd-5712-839c-85711c8995fe",
      "id": "CVE-2024-22262",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.31-tuxcare.7 of org.springframework:spring-web."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.7"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:c15bd386-fc6d-5e72-b07f-7ec480d5fb25",
      "id": "CVE-2024-38808",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.31-tuxcare.7 of org.springframework:spring-web."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.7"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:0a174fc9-93da-5046-b450-00b2aa2cb3e9",
      "id": "CVE-2024-38809",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.31-tuxcare.7 of org.springframework:spring-web."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.7"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:9c3ff9a6-df04-5cd5-a295-175189a217d7",
      "id": "CVE-2024-38816",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.31-tuxcare.7 of org.springframework:spring-web."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.7"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:17fd8ec5-a7b9-5460-a93a-7e095b2ad1ca",
      "id": "CVE-2024-38819",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.31-tuxcare.7 of org.springframework:spring-web."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.7"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:e58e16d2-1a5a-577e-a88f-c4827eedcc13",
      "id": "CVE-2024-38820",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.31-tuxcare.7 of org.springframework:spring-web."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.7"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:ec2510f2-30fc-5922-901c-50703d28dc17",
      "id": "CVE-2024-38828",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.31-tuxcare.7 of org.springframework:spring-web."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.7"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:11690117-17a5-5a13-8cf2-1b568b6d5fac",
      "id": "CVE-2025-22233",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.31-tuxcare.7 of org.springframework:spring-web."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.7"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:b6765147-e55e-50d4-9ef5-c181d077871b",
      "id": "CVE-2025-41234",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring-web 5.3.31-tuxcare.7."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.7"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:aac55c40-730b-53d3-a505-4dafc458d136",
      "id": "CVE-2025-41242",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.31-tuxcare.7 of org.springframework:spring-web."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.7"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:12a91e5f-3c5b-5338-bcd5-371a60ada992",
      "id": "CVE-2025-41249",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.31-tuxcare.7 of org.springframework:spring-web."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.7"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:bdf0d9a4-cbb3-5f95-be92-92d6d428082a",
      "id": "CVE-2025-41254",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.31-tuxcare.7 of org.springframework:spring-web."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.7"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d191f5c9-89e0-504d-9d31-eb93ca9b3928",
      "id": "CVE-2026-22735",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.31-tuxcare.7 of org.springframework:spring-web."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.7"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:c73541d0-52bd-5620-960c-ce628800c080",
      "id": "CVE-2026-22737",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.31-tuxcare.7 of org.springframework:spring-web."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.7"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:ef475804-fd03-5749-b187-34fa434efa64",
      "id": "CVE-2026-22740",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.31-tuxcare.7 of org.springframework:spring-web."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.7"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:2d3d3063-6daa-5ab1-9ca1-233fa2ec9c0b",
      "id": "CVE-2026-22741",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-22741 affects version 5.3.31-tuxcare.7 of org.springframework:spring-web."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.7"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:7db6833f-5769-5c32-8d24-548024ca14bf",
      "id": "CVE-2026-22745",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.31-tuxcare.7 of org.springframework:spring-web."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.7"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:88543cfe-6a77-5c57-844d-cff798085832",
      "id": "CVE-2026-41838",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.31-tuxcare.7 of org.springframework:spring-web."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.7"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:b95bddee-a356-58a5-9c98-69c6e2923b76",
      "id": "CVE-2026-41839",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.31-tuxcare.7 of org.springframework:spring-web."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.7"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:f1dcccb8-4e2a-5f63-a37e-00349555eea5",
      "id": "CVE-2026-41840",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.31-tuxcare.7 of org.springframework:spring-web. already_fixed \u2014 The target repository (Spring Framework 5.3.31-tuxcare.3) already contains the complete fix for CVE-2026-41840. Both required doOnDiscard handlers were applied via commit 615477c88f (labeled as CVE-2026-22740 backport) merged on May 4, 2026. The code changes are byte-for-byte identical to the upstream patches."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.7"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d47e2050-88f2-5276-9cba-b5532b8a1bac",
      "id": "CVE-2026-41841",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41841 affects version 5.3.31-tuxcare.7 of org.springframework:spring-web."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.7"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:b3dbe094-f4e9-53b4-90e9-5faaa420bb77",
      "id": "CVE-2026-41842",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41842 affects version 5.3.31-tuxcare.7 of org.springframework:spring-web."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.7"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:182d49c2-2bb2-5bcc-ab1e-a57a2d16bc84",
      "id": "CVE-2026-41843",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41843 affects version 5.3.31-tuxcare.7 of org.springframework:spring-web."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.7"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:dba38347-e3c2-53cd-9616-31d55f225907",
      "id": "CVE-2026-41844",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.31-tuxcare.7 of org.springframework:spring-web."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.7"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:27221d31-13d0-565e-bd7e-e63e1a456a44",
      "id": "CVE-2026-41845",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.31-tuxcare.7 of org.springframework:spring-web."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.7"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:f8abc3bc-41d1-5a02-ab11-4b084271b1b8",
      "id": "CVE-2026-41846",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41846 affects version 5.3.31-tuxcare.7 of org.springframework:spring-web."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.7"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:01afa246-acd8-5b39-8fe0-9b1995bf5abb",
      "id": "CVE-2026-41847",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41847 affects version 5.3.31-tuxcare.7 of org.springframework:spring-web."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.7"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:4e1da8bd-0275-5dfa-94b4-affd1fafaef3",
      "id": "CVE-2026-41848",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.31-tuxcare.7 of org.springframework:spring-web."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.7"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:5bc29bda-abc9-54f2-a52a-8a4e85bd012d",
      "id": "CVE-2026-41849",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41849 affects version 5.3.31-tuxcare.7 of org.springframework:spring-web."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.7"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:fedf0689-88b4-5d4e-8ce5-571b47220515",
      "id": "CVE-2026-41850",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41850 affects version 5.3.31-tuxcare.7 of org.springframework:spring-web."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.7"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:22fc366b-2312-59b2-8a3f-0707e981737b",
      "id": "CVE-2026-41851",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41851 affects version 5.3.31-tuxcare.7 of org.springframework:spring-web."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.7"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:1135d820-4aa6-5ad5-bc31-7af2e05dcec2",
      "id": "CVE-2026-41852",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41852 affects version 5.3.31-tuxcare.7 of org.springframework:spring-web."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.7"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:b3c7019c-5a87-55e3-aff3-64af274e3110",
      "id": "CVE-2026-41853",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.31-tuxcare.7 of org.springframework:spring-web."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.7"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:de949be8-2056-5e15-bbd3-1d6b70a9dd7d",
      "id": "CVE-2026-41855",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.31-tuxcare.7 of org.springframework:spring-web."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.7"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-web@5.3.31-tuxcare.7"
    }
  ]
}