{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:96966732-cc05-54d4-ae47-72c5bfe52749",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-aop",
      "purl": "pkg:maven/org.springframework/spring-aop@5.3.29-tuxcare.11",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-aop@5.3.29-tuxcare.11",
      "version": "5.3.29-tuxcare.11",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-aop",
            "purl": "pkg:maven/org.springframework/spring-aop@5.3.29",
            "type": "library",
            "group": "org.springframework",
            "version": "5.3.29"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2009-1190",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-aop@5.3.29-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:b71fe74d-9943-5471-a8e9-f1284cb30c1d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2009-1190 affects version 5.3.29-tuxcare.11 of org.springframework:spring-aop."
      }
    },
    {
      "id": "CVE-2011-2730",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-aop@5.3.29-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:dc812055-df42-50e8-8180-f88a5b67818b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2011-2730 affects version 5.3.29-tuxcare.11 of org.springframework:spring-aop."
      }
    },
    {
      "id": "CVE-2011-2894",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-aop@5.3.29-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:4b8a3255-3cdf-5d38-921c-9efbb5ec0b0d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2011-2894 affects version 5.3.29-tuxcare.11 of org.springframework:spring-aop."
      }
    },
    {
      "id": "CVE-2014-3578",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-aop@5.3.29-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:634def0e-919b-5890-b710-1d6c87895ecc",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2014-3578 affects version 5.3.29-tuxcare.11 of org.springframework:spring-aop."
      }
    },
    {
      "id": "CVE-2015-0201",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-aop@5.3.29-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:0a4a6d05-45fc-51e3-8b06-39a894de6c99",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2015-0201 affects version 5.3.29-tuxcare.11 of org.springframework:spring-aop."
      }
    },
    {
      "id": "CVE-2015-5211",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-aop@5.3.29-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:31a3073c-9f69-5a65-9914-140bcd11dd95",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2015-5211 affects version 5.3.29-tuxcare.11 of org.springframework:spring-aop."
      }
    },
    {
      "id": "CVE-2016-5007",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-aop@5.3.29-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:149e075b-94d9-57e4-ae45-0e72be5867f7",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2016-5007 affects version 5.3.29-tuxcare.11 of org.springframework:spring-aop."
      }
    },
    {
      "id": "CVE-2018-11040",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-aop@5.3.29-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:165ae622-b33b-5382-bfec-8d2fffb20626",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-11040 affects version 5.3.29-tuxcare.11 of org.springframework:spring-aop."
      }
    },
    {
      "id": "CVE-2018-1199",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-aop@5.3.29-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:8042ffa8-27a4-5076-bfbb-9ee261376521",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1199 affects version 5.3.29-tuxcare.11 of org.springframework:spring-aop."
      }
    },
    {
      "id": "CVE-2018-1257",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-aop@5.3.29-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:0d43e96b-f348-56fb-8d27-b40156ce336d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1257 does not affect version 5.3.29-tuxcare.11 of org.springframework:spring-aop. not_affected \u2014 CVE-2018-1257 affects Spring Framework versions 5.0.x prior to 5.0.6 and 4.3.x prior to 4.3.17, involving a regular expression denial of service through malicious STOMP selector headers. The target version 5.3.29-tuxcare.12 is not affected because the fix was already present in the upstream Spring Framework 5.3.29 release. The vulnerable code pattern (unconstrained parsing of selector expressio...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1258",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-aop@5.3.29-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:fb916723-e0ce-5cb5-81d5-b5981af14486",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1258 affects version 5.3.29-tuxcare.11 of org.springframework:spring-aop."
      }
    },
    {
      "id": "CVE-2018-1271",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-aop@5.3.29-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:4feb7c03-60a1-5038-a51b-45392f9431ed",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1271 affects version 5.3.29-tuxcare.11 of org.springframework:spring-aop."
      }
    },
    {
      "id": "CVE-2018-1272",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-aop@5.3.29-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:ce2b5f0d-215d-53b1-8e8e-eadb869039e8",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1272 affects version 5.3.29-tuxcare.11 of org.springframework:spring-aop."
      }
    },
    {
      "id": "CVE-2018-15756",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-aop@5.3.29-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:b7846478-3006-5467-b68d-1f6011a3d369",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-15756 affects version 5.3.29-tuxcare.11 of org.springframework:spring-aop."
      }
    },
    {
      "id": "CVE-2021-22060",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-aop@5.3.29-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:c29bb8a0-e28b-5f5c-a78a-3da410b86c72",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-22060 affects version 5.3.29-tuxcare.11 of org.springframework:spring-aop."
      }
    },
    {
      "id": "CVE-2021-22096",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-aop@5.3.29-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:6b46de7d-992e-52ab-83a7-fc1cad7f1fc5",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-22096 affects version 5.3.29-tuxcare.11 of org.springframework:spring-aop."
      }
    },
    {
      "id": "CVE-2022-22965",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-aop@5.3.29-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:a8266f35-4052-5e4d-bc7e-424baf65713c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22965 does not affect version 5.3.29-tuxcare.11 of org.springframework:spring-aop. Spring Framework 5.3.29 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22970",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-aop@5.3.29-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:108b9ea4-1153-5bd0-8de0-8c73580ec8b1",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22970 does not affect version 5.3.29-tuxcare.11 of org.springframework:spring-aop. not_affected \u2014 CVE-2022-22970 has been fixed in the target Spring Framework 5.3.29. The vulnerability involved unfiltered AutoCloseable-typed read-only properties during bean introspection, enabling DoS attacks through file upload data binding. The upstream fix (commit 83186b689f, May 2022) added filtering for AutoCloseable, ClassLoader, ProtectionDomain, and URL.content properties. A refinement (commit ec3f5...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-22233",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-aop@5.3.29-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:d3252ded-409d-5535-9bc0-19b9bd8e9c08",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-22233 affects version 5.3.29-tuxcare.11 of org.springframework:spring-aop."
      }
    },
    {
      "id": "CVE-2025-41249",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-aop@5.3.29-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:cee55478-3bd1-5322-893a-b5d3b44d4b64",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-aop."
      }
    },
    {
      "id": "CVE-2026-41848",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-aop@5.3.29-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:ae2caf5e-f366-57cf-bab0-7776a56e8801",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-aop."
      }
    },
    {
      "id": "CVE-2026-59282",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-aop@5.3.29-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:a1a17398-d462-5f62-b37d-a34b21c6cdcc",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-aop."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-aop@5.3.29-tuxcare.11"
    }
  ]
}