{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:813653df-21d1-527a-bfd4-9df1ddbd7ac7",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-integration-sftp",
      "purl": "pkg:maven/org.springframework.integration/spring-integration-sftp@6.5.9-tuxcare.5",
      "type": "library",
      "group": "org.springframework.integration",
      "bom-ref": "pkg:maven/org.springframework.integration/spring-integration-sftp@6.5.9-tuxcare.5",
      "version": "6.5.9-tuxcare.5",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-integration-sftp",
            "purl": "pkg:maven/org.springframework.integration/spring-integration-sftp@6.5.9",
            "type": "library",
            "group": "org.springframework.integration",
            "version": "6.5.9"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2020-5413",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.integration/spring-integration-sftp@6.5.9-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:4f3d61b6-a664-5f5b-b2fb-97396a9b0541",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2020-5413 affects version 6.5.9-tuxcare.5 of org.springframework.integration:spring-integration-sftp."
      }
    },
    {
      "id": "CVE-2026-40987",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.integration/spring-integration-sftp@6.5.9-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:f6917267-045b-5782-b8de-dd4f095a91fe",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-40987 does not affect version 6.5.9-tuxcare.5 of org.springframework.integration:spring-integration-sftp. Spring Integration 6.5.9 contains the upstream fix for CVE-2026-40987 (path traversal in FTP/SFTP/SMB file downloads). The defense method FileUtils.newFileInDirectoryIfValid() validates all file paths before creation, rejecting absolute paths and directory traversal sequences. This fix was present in the upstream Spring Integration 6.5.9 release (authored by Glenn Renfro from Broadcom on June 1.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-47856",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.integration/spring-integration-sftp@6.5.9-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:72c9d97c-6c67-5aef-9e56-d8b3a691e994",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47856 is fixed in version 6.5.9-tuxcare.5 of org.springframework.integration:spring-integration-sftp."
      }
    },
    {
      "id": "CVE-2026-59292",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.integration/spring-integration-sftp@6.5.9-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:a081ee2e-5d52-5e35-a5f4-2fd520d40562",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59292 is fixed in version 6.5.9-tuxcare.5 of org.springframework.integration:spring-integration-sftp."
      }
    },
    {
      "id": "CVE-2026-59322",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.integration/spring-integration-sftp@6.5.9-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:c210dd76-39bd-50a9-9817-1a3db4022598",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59322 is fixed in version 6.5.9-tuxcare.5 of org.springframework.integration:spring-integration-sftp."
      }
    },
    {
      "id": "CVE-2026-59324",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.integration/spring-integration-sftp@6.5.9-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:2e2c1781-aa59-5893-8926-67bcacfdaeda",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59324 is fixed in version 6.5.9-tuxcare.5 of org.springframework.integration:spring-integration-sftp."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.integration/spring-integration-sftp@6.5.9-tuxcare.5"
    }
  ]
}