{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:c7814ed5-a92e-547d-b3a1-c6bc11facee9",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.9",
      "type": "library",
      "group": "org.springframework",
      "name": "spring",
      "version": "5.3.31-tuxcare.9",
      "purl": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.9"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:388f356d-9018-5812-8974-d0101ae6441e",
      "id": "CVE-2016-1000027",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.31-tuxcare.9 of org.springframework:spring."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:a5a90539-fac6-55a9-9b80-13c2e5be1df4",
      "id": "CVE-2024-22243",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:440fda6b-cdd0-5091-9c53-21b6e1b1f2ea",
      "id": "CVE-2024-22259",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:2aef3dbc-d842-534a-ab53-d1a87702f544",
      "id": "CVE-2024-22262",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:567bb560-507f-5de3-a72c-9a31c67bc768",
      "id": "CVE-2024-38808",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:1ee4941c-c794-5be3-83e8-08785a96fa83",
      "id": "CVE-2024-38809",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:1c7aa075-eca5-5600-84af-5eda78ac6559",
      "id": "CVE-2024-38816",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:88194339-eea6-5352-a1a6-952f89d4c29d",
      "id": "CVE-2024-38819",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:28b3f9af-7140-52a7-830d-a0b0bc793ea2",
      "id": "CVE-2024-38820",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:61764dbf-ff0a-569a-9dd6-5c7be348911f",
      "id": "CVE-2024-38828",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d871139c-16ed-5b50-be37-51adcab83802",
      "id": "CVE-2025-22233",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:0a54048e-245e-5852-bd5f-5b1ed069f898",
      "id": "CVE-2025-41234",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring 5.3.31-tuxcare.9."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:cf69e66c-ef31-5514-a408-0eb0728555e6",
      "id": "CVE-2025-41242",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:7924dd0f-fa9a-5599-8fda-43072185b98d",
      "id": "CVE-2025-41249",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:bb085109-054f-598d-b951-371690e30d32",
      "id": "CVE-2025-41254",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:67f5b7df-9897-527c-882d-4e457e922934",
      "id": "CVE-2026-22735",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:f128bffe-5368-5142-88d5-ae42ef9e37f1",
      "id": "CVE-2026-22737",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:c64714ab-12ed-5992-8ed7-4c8cc7ff7581",
      "id": "CVE-2026-22740",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:db538887-1d35-551f-a8fe-84b8dcd20910",
      "id": "CVE-2026-22741",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:2be6ef4e-3dac-5b4e-8bff-bb47aa7208c3",
      "id": "CVE-2026-22745",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:0a1f0d8b-c322-5c1a-81a9-b81d57037c82",
      "id": "CVE-2026-41838",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:49b8f797-d531-5d3d-a9e9-cdc8e4fe74cd",
      "id": "CVE-2026-41839",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:20d338c1-a07c-57f6-882d-20c0521ad8a4",
      "id": "CVE-2026-41840",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.31-tuxcare.9 of org.springframework:spring. already_fixed \u2014 The target repository (Spring Framework 5.3.31-tuxcare.3) already contains the complete fix for CVE-2026-41840. Both required doOnDiscard handlers were applied via commit 615477c88f (labeled as CVE-2026-22740 backport) merged on May 4, 2026. The code changes are byte-for-byte identical to the upstream patches."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:8129192e-bf0a-52ef-8807-c76656784950",
      "id": "CVE-2026-41841",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41841 affects version 5.3.31-tuxcare.9 of org.springframework:spring."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:7e4eda9f-264d-5a3a-b3f5-caf9079a4ce9",
      "id": "CVE-2026-41842",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41842 affects version 5.3.31-tuxcare.9 of org.springframework:spring."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:9b17f198-efe3-5be9-9870-3621956a4f19",
      "id": "CVE-2026-41843",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41843 affects version 5.3.31-tuxcare.9 of org.springframework:spring."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:cbf44da1-39a5-5cb1-83b2-dabdc570cf9d",
      "id": "CVE-2026-41844",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:8dff080e-ae7a-548f-8124-8543a7cbcf44",
      "id": "CVE-2026-41845",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:5b1840ad-99eb-5b3f-982b-7a5465c25937",
      "id": "CVE-2026-41846",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d46b51c1-2702-52e7-acd3-6321564a41ac",
      "id": "CVE-2026-41847",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41847 affects version 5.3.31-tuxcare.9 of org.springframework:spring."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:a1e4327e-2cd6-587b-b6d5-0b8ec4afaa93",
      "id": "CVE-2026-41848",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:888e9fb1-1f5c-5caa-ac41-912fdb14ad88",
      "id": "CVE-2026-41849",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:9158eb4d-96f9-5a10-a472-202485cb7ee4",
      "id": "CVE-2026-41850",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41850 affects version 5.3.31-tuxcare.9 of org.springframework:spring."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:2706fa16-6b3b-5e27-9f40-d3d311298c0b",
      "id": "CVE-2026-41851",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41851 affects version 5.3.31-tuxcare.9 of org.springframework:spring."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:e7e5ad4f-6b99-5def-8a54-9928d1e85c7e",
      "id": "CVE-2026-41852",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41852 affects version 5.3.31-tuxcare.9 of org.springframework:spring."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d0232c79-fc6a-5720-9ca9-5fb27fc9243b",
      "id": "CVE-2026-41853",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.9"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:463798c5-f6e4-522e-a244-0eaffd27c52f",
      "id": "CVE-2026-41855",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.31-tuxcare.9 of org.springframework:spring."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.9"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring@5.3.31-tuxcare.9"
    }
  ]
}