{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:99888f43-0531-5760-a85f-5370fd8c2c5e",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:maven/org.springframework/spring@5.3.27-tuxcare.6",
      "type": "library",
      "group": "org.springframework",
      "name": "spring",
      "version": "5.3.27-tuxcare.6",
      "purl": "pkg:maven/org.springframework/spring@5.3.27-tuxcare.6"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:8dd91205-8280-5c94-94b2-dbf68b84aede",
      "id": "CVE-2016-1000027",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.27-tuxcare.6 of org.springframework:spring."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.27-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:8a2fa4b5-c458-5fa5-927a-f23d97f71252",
      "id": "CVE-2024-22243",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.27-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:6e663aab-2213-5120-87c7-d4e4978da043",
      "id": "CVE-2024-22259",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.27-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:c670cd90-d630-5d6e-a530-47d09508e22f",
      "id": "CVE-2024-22262",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.27-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:fb375004-6d13-54f6-80c7-a48bd16acc18",
      "id": "CVE-2024-38808",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.27-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:8a6a48a6-4702-5c56-81b8-2157caa1bb70",
      "id": "CVE-2024-38809",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.27-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d7091fec-8caf-5fde-a46d-fe6ccb149dee",
      "id": "CVE-2024-38816",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.27-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:e1040d69-846f-5c2b-b3e1-208cdb184aa0",
      "id": "CVE-2024-38819",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.27-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d24eb822-8bae-555e-931a-edf442088ca0",
      "id": "CVE-2024-38820",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.27-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:47e4720c-fae5-509f-9847-e9fece9a1de8",
      "id": "CVE-2024-38828",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.27-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:b8a87194-e1fd-5507-8f3d-0379ea10e39a",
      "id": "CVE-2025-22233",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.27-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:fa27eb54-8ec3-5574-825c-2c0fd2021a7e",
      "id": "CVE-2025-41234",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring 5.3.27-tuxcare.6."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.27-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:ea565464-5551-5da4-9c9d-aea85849fde1",
      "id": "CVE-2025-41242",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.27-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:e10aae0c-e807-55ba-8847-201643aea317",
      "id": "CVE-2025-41249",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.27-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:29d3b69f-df6b-5b0d-8922-958785af016e",
      "id": "CVE-2025-41254",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.27-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:60071dd7-14bc-59ed-bcee-547dfa925225",
      "id": "CVE-2026-22735",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.27-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:503b96e7-969e-5508-8824-d5df8ab575a0",
      "id": "CVE-2026-22737",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.27-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:9be6cf74-c893-50be-9dd9-4cd7ecf15d52",
      "id": "CVE-2026-22740",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.27-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:33ad98a0-dc5f-594e-83a7-c57bd0335ac3",
      "id": "CVE-2026-22741",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.27-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:8d613644-8d21-541e-8c50-91e89a7fe9d3",
      "id": "CVE-2026-22745",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.27-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:ecbf211a-5552-5cdb-a5cb-b55bde49231e",
      "id": "CVE-2026-41838",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.27-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:dd3a072a-2e06-59cf-a65d-c251ab80c490",
      "id": "CVE-2026-41839",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.27-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:c3eada4d-5a1d-5eee-8162-8573351c9577",
      "id": "CVE-2026-41840",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.27-tuxcare.6 of org.springframework:spring. already_fixed \u2014 The target repository (Spring Framework 5.3.27-tuxcare.5) already contains the fix for CVE-2026-41840. The vulnerability was previously addressed through backport commits for CVE-2026-22740, which applied the identical doOnDiscard cleanup logic to prevent resource exhaustion from multipart request processing."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.27-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:05860bff-68fa-5666-8b8c-cceb87ff5918",
      "id": "CVE-2026-41841",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41841 affects version 5.3.27-tuxcare.6 of org.springframework:spring."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.27-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:665ffb93-bebc-5c88-84e1-84ef1d51f850",
      "id": "CVE-2026-41842",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41842 affects version 5.3.27-tuxcare.6 of org.springframework:spring."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.27-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:9b039df2-52d6-51b6-a1a2-a145987f72bb",
      "id": "CVE-2026-41843",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41843 affects version 5.3.27-tuxcare.6 of org.springframework:spring."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.27-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:0fa75337-2ebc-56c8-837b-691bba2c7671",
      "id": "CVE-2026-41844",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.27-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:25eb5f72-3779-515b-892e-83fd3ad2a742",
      "id": "CVE-2026-41845",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.27-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:5d4db841-86d6-58a2-83c7-e2321e519656",
      "id": "CVE-2026-41846",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.27-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:5238a3b2-4a9e-580f-b149-8122f593d994",
      "id": "CVE-2026-41847",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41847 does not affect version 5.3.27-tuxcare.6 of org.springframework:spring. All 1 patch commits already exist in target branch"
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.27-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:a82504a5-223f-57f6-8c57-4e64071d938a",
      "id": "CVE-2026-41848",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41848 affects version 5.3.27-tuxcare.6 of org.springframework:spring."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.27-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:cac84ac5-0e10-540b-b911-f2c5e5c2402f",
      "id": "CVE-2026-41849",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41849 affects version 5.3.27-tuxcare.6 of org.springframework:spring."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.27-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:625580d7-5547-5805-b43c-a37c81ade9aa",
      "id": "CVE-2026-41850",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41850 affects version 5.3.27-tuxcare.6 of org.springframework:spring."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.27-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:9ded011c-00e3-502f-ae0c-7b210c67d15e",
      "id": "CVE-2026-41851",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41851 affects version 5.3.27-tuxcare.6 of org.springframework:spring."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.27-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:9d966d04-08b1-5039-970e-2d9d94e4788c",
      "id": "CVE-2026-41852",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41852 affects version 5.3.27-tuxcare.6 of org.springframework:spring."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.27-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:3de0bded-e25e-567f-99c1-e65af19eef32",
      "id": "CVE-2026-41853",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.27-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:e1dab1ec-7468-599f-88fe-06d2c5d2804f",
      "id": "CVE-2026-41855",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41855 affects version 5.3.27-tuxcare.6 of org.springframework:spring."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.27-tuxcare.6"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring@5.3.27-tuxcare.6"
    }
  ]
}