{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:7d5e00be-fae2-54bc-ba2d-9dfc2106d3c1",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-aop",
      "purl": "pkg:maven/org.springframework/spring-aop@4.1.7.RELEASE-tuxcare.7",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-aop@4.1.7.RELEASE-tuxcare.7",
      "version": "4.1.7.RELEASE-tuxcare.7",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-aop",
            "purl": "pkg:maven/org.springframework/spring-aop@4.1.7.RELEASE",
            "type": "library",
            "group": "org.springframework",
            "version": "4.1.7.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2009-1190",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-aop@4.1.7.RELEASE-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:8990b4ae-211b-5004-9f1a-bca4bf039359",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2009-1190 does not affect version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-aop. not_affected \u2014 Spring Framework 4.1.7.RELEASE is not affected by CVE-2009-1190. The vulnerability is fundamentally in JDK < 1.6's Pattern.compile method (algorithmic complexity with regex patterns containing multiple optional groups). This Spring version requires JDK 8, which is 8 years newer than JDK 1.6 where the underlying JDK issue was fixed. The target version (4.1.7.RELEASE from 2015) is also much newer...",
        "justification": "requires_environment"
      }
    },
    {
      "id": "CVE-2011-2730",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-aop@4.1.7.RELEASE-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:8e7ff74d-3e90-5a68-a2a6-c921a60804c4",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2011-2730 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-aop."
      }
    },
    {
      "id": "CVE-2011-2894",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-aop@4.1.7.RELEASE-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:b680bb9d-8725-56df-a161-d865159c3040",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2011-2894 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-aop."
      }
    },
    {
      "id": "CVE-2014-3578",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-aop@4.1.7.RELEASE-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:01d5f319-cad7-57a7-b56c-e2930d0e496a",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2014-3578 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-aop."
      }
    },
    {
      "id": "CVE-2015-0201",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-aop@4.1.7.RELEASE-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:a448cc27-530b-5821-a23f-4b331cac8c96",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2015-0201 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-aop."
      }
    },
    {
      "id": "CVE-2015-5211",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-aop@4.1.7.RELEASE-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:24d69960-4fe8-5b94-b662-d205625aa822",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2015-5211 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-aop."
      }
    },
    {
      "id": "CVE-2016-5007",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-aop@4.1.7.RELEASE-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:e48c51c5-b885-5c8c-b1c5-78fa981fb193",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2016-5007 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-aop."
      }
    },
    {
      "id": "CVE-2018-11040",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-aop@4.1.7.RELEASE-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:88c14c69-7f5b-5b7f-99e5-d25608b6d648",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2018-11040 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-aop."
      }
    },
    {
      "id": "CVE-2018-1199",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-aop@4.1.7.RELEASE-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:9383fc29-cfcb-5a39-b413-8631cf92222c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1199 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-aop."
      }
    },
    {
      "id": "CVE-2018-1257",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-aop@4.1.7.RELEASE-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:e67061cc-3ea4-5292-a7d1-2e673bacbf92",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1257 does not affect version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-aop. The version is not vulnerable. [terminalized not_affected from patch_application_manual/not_vulnerable]",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1258",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-aop@4.1.7.RELEASE-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:0ef15975-baad-576f-a72f-517faae57bc1",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1258 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-aop."
      }
    },
    {
      "id": "CVE-2018-1271",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-aop@4.1.7.RELEASE-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:b5d20723-5934-5b7b-bbc0-b4a315295c4b",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2018-1271 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-aop."
      }
    },
    {
      "id": "CVE-2018-1272",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-aop@4.1.7.RELEASE-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:89c19ba6-4a8d-598b-a65b-0a6ef8024f5e",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2018-1272 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-aop."
      }
    },
    {
      "id": "CVE-2018-15756",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-aop@4.1.7.RELEASE-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:fb64ef4d-6dab-5bcf-a16e-61b5f335613b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-15756 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-aop."
      }
    },
    {
      "id": "CVE-2021-22060",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-aop@4.1.7.RELEASE-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:adca93cf-3cfa-58bc-9511-03a233f89795",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-22060 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-aop."
      }
    },
    {
      "id": "CVE-2021-22096",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-aop@4.1.7.RELEASE-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:55cd455a-d6c3-5c7d-bfaf-ea15175c61f6",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2021-22096 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-aop."
      }
    },
    {
      "id": "CVE-2022-22965",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-aop@4.1.7.RELEASE-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:77d73705-3248-5384-a4bc-475cd1c5311d",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-aop."
      }
    },
    {
      "id": "CVE-2022-22970",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-aop@4.1.7.RELEASE-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:8a9056c2-e24d-53da-a189-a6246b3e9146",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-22970 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-aop."
      }
    },
    {
      "id": "CVE-2024-22233",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-aop@4.1.7.RELEASE-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:274522ad-1de7-5b6a-a7f9-54b0a0e2cdc0",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-22233 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-aop."
      }
    },
    {
      "id": "CVE-2025-41249",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-aop@4.1.7.RELEASE-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:eb73f338-70b3-557e-8572-aaa70dc939d5",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-41249 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-aop."
      }
    },
    {
      "id": "CVE-2026-22740",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-aop@4.1.7.RELEASE-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:3ec21421-6121-546a-863c-48c69ea509c8",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-22740 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-aop."
      }
    },
    {
      "id": "CVE-2026-41848",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-aop@4.1.7.RELEASE-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:2b86e24a-6a45-54e3-b0a1-dcc1717fda55",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41848 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-aop."
      }
    },
    {
      "id": "CVE-2026-59282",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-aop@4.1.7.RELEASE-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:56be0a1d-d80f-5d8e-b293-c893579ce7f6",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59282 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-aop."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-aop@4.1.7.RELEASE-tuxcare.7"
    }
  ]
}