{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:57f5e85e-7918-5e8b-876c-2a27b547a829",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-aop",
      "purl": "pkg:maven/org.springframework/spring-aop@5.3.32-tuxcare.3",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-aop@5.3.32-tuxcare.3",
      "version": "5.3.32-tuxcare.3",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-aop",
            "purl": "pkg:maven/org.springframework/spring-aop@5.3.32",
            "type": "library",
            "group": "org.springframework",
            "version": "5.3.32"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2009-1190",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-aop@5.3.32-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:919b8cd1-4d89-56f5-9197-3beb5c4abb6f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2009-1190 affects version 5.3.32-tuxcare.3 of org.springframework:spring-aop."
      }
    },
    {
      "id": "CVE-2011-2730",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-aop@5.3.32-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:2bb9951d-dde6-5f03-8689-7d7891948577",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2011-2730 affects version 5.3.32-tuxcare.3 of org.springframework:spring-aop."
      }
    },
    {
      "id": "CVE-2011-2894",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-aop@5.3.32-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:5431d77c-0758-5e97-90e3-284005833ef8",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2011-2894 affects version 5.3.32-tuxcare.3 of org.springframework:spring-aop."
      }
    },
    {
      "id": "CVE-2014-3578",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-aop@5.3.32-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:00363802-2e9f-5a5b-84e0-19de52f628cb",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2014-3578 affects version 5.3.32-tuxcare.3 of org.springframework:spring-aop."
      }
    },
    {
      "id": "CVE-2015-0201",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-aop@5.3.32-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:f58ae6c1-0929-5106-ae76-7388a3631a47",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2015-0201 affects version 5.3.32-tuxcare.3 of org.springframework:spring-aop."
      }
    },
    {
      "id": "CVE-2015-5211",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-aop@5.3.32-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:d605d57c-7c7a-5013-838b-d6af4d843257",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2015-5211 affects version 5.3.32-tuxcare.3 of org.springframework:spring-aop."
      }
    },
    {
      "id": "CVE-2016-5007",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-aop@5.3.32-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:f578f3a2-33e5-50df-bb83-3ca1921dd1b8",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2016-5007 affects version 5.3.32-tuxcare.3 of org.springframework:spring-aop."
      }
    },
    {
      "id": "CVE-2018-11040",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-aop@5.3.32-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:1e063346-617c-5a31-b11d-f4bd4422dc16",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-11040 affects version 5.3.32-tuxcare.3 of org.springframework:spring-aop."
      }
    },
    {
      "id": "CVE-2018-1199",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-aop@5.3.32-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:d66aeef0-9a46-5605-8138-4e6c8c506547",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1199 affects version 5.3.32-tuxcare.3 of org.springframework:spring-aop."
      }
    },
    {
      "id": "CVE-2018-1257",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-aop@5.3.32-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:3b006b58-8ce3-538b-a2a1-b67b6f6a5b49",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1257 does not affect version 5.3.32-tuxcare.3 of org.springframework:spring-aop. not_affected \u2014 The target Spring Framework 5.3.32 is NOT affected by CVE-2018-1257 (STOMP selector ReDoS vulnerability). The upstream vendor fix was already present in the 5.3.32 release that TuxCare onboarded. The fix adds a null-check guard around selector expression parsing in DefaultSubscriptionRegistry.getSelectorExpression() (lines 162-164), allowing the selector feature to be disabled entirely by setti...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1258",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-aop@5.3.32-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:02c750e4-1d95-554e-a2f3-03629f3425ad",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1258 affects version 5.3.32-tuxcare.3 of org.springframework:spring-aop."
      }
    },
    {
      "id": "CVE-2018-1271",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-aop@5.3.32-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:43903fa3-6d1f-53ac-8c30-09ba249a6d7f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1271 affects version 5.3.32-tuxcare.3 of org.springframework:spring-aop."
      }
    },
    {
      "id": "CVE-2018-1272",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-aop@5.3.32-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:c94d57a6-b89e-5933-a8b1-026a48cdec15",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1272 affects version 5.3.32-tuxcare.3 of org.springframework:spring-aop."
      }
    },
    {
      "id": "CVE-2018-15756",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-aop@5.3.32-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:fd08429f-4290-5c1c-a710-71a1e78462dd",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-15756 affects version 5.3.32-tuxcare.3 of org.springframework:spring-aop."
      }
    },
    {
      "id": "CVE-2021-22060",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-aop@5.3.32-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:4e4e32c1-ab94-5c05-b414-1ae44657fa4f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-22060 affects version 5.3.32-tuxcare.3 of org.springframework:spring-aop."
      }
    },
    {
      "id": "CVE-2021-22096",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-aop@5.3.32-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:42867a52-a16b-5273-ab08-facfdfe8f38c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-22096 affects version 5.3.32-tuxcare.3 of org.springframework:spring-aop."
      }
    },
    {
      "id": "CVE-2022-22965",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-aop@5.3.32-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:a27e2f00-9631-5a9c-b899-56bdf9bf0a51",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22965 does not affect version 5.3.32-tuxcare.3 of org.springframework:spring-aop. Spring Framework 5.3.32 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22970",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-aop@5.3.32-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:e4966c77-8a71-5b16-ae0e-569ebd6e8b52",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22970 does not affect version 5.3.32-tuxcare.3 of org.springframework:spring-aop. not_affected \u2014 CVE-2022-22970 fix was already present in the upstream Spring Framework 5.3.32 release. The vulnerability affects applications handling file uploads with data binding to MultipartFile/Part fields, allowing DoS through repeated access to expensive read-only property getters. The fix (commit 83186b689f, May 2022) filters AutoCloseable, ClassLoader, and ProtectionDomain read-only properties during...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-22233",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-aop@5.3.32-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:a5f9fad0-bc22-5c16-8867-04608a6c83d6",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-22233 affects version 5.3.32-tuxcare.3 of org.springframework:spring-aop."
      }
    },
    {
      "id": "CVE-2025-41249",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-aop@5.3.32-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:03ea1472-e96f-52fb-94a3-f389086cfef4",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-41249 affects version 5.3.32-tuxcare.3 of org.springframework:spring-aop."
      }
    },
    {
      "id": "CVE-2026-41848",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-aop@5.3.32-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:1a2ac7eb-6b15-5fca-88eb-d85c3fed4ef4",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.32-tuxcare.3 of org.springframework:spring-aop."
      }
    },
    {
      "id": "CVE-2026-59282",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-aop@5.3.32-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:982fd47f-3d7a-5d42-863e-3412d295f6d0",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.32-tuxcare.3 of org.springframework:spring-aop."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-aop@5.3.32-tuxcare.3"
    }
  ]
}