{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:80b8c8d1-2223-5cbe-8e85-4017feda8f06",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-asm",
      "purl": "pkg:maven/org.springframework/spring-asm@3.0.5.RELEASE-tuxcare.12",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-asm@3.0.5.RELEASE-tuxcare.12",
      "version": "3.0.5.RELEASE-tuxcare.12",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-asm",
            "purl": "pkg:maven/org.springframework/spring-asm@3.0.5.RELEASE",
            "type": "library",
            "group": "org.springframework",
            "version": "3.0.5.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-asm@3.0.5.RELEASE-tuxcare.12"
        }
      ],
      "bom-ref": "urn:uuid:5b9c07c2-97a9-5f16-88fd-ffd86d1c2529",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 3.0.5.RELEASE-tuxcare.12 of org.springframework:spring-asm. Spring Framework 3.0.5.RELEASE is not affected by CVE-2018-1270. The vulnerability requires the spring-messaging module with STOMP over WebSocket support, which was introduced in Spring Framework 4.0 (December 2013). Spring Framework 3.0.5 (released December 2010) predates this feature and does not contain the vulnerable component (DefaultSubscriptionRegistry) or any STOMP/WebSocket infrastructure. The attack vector\u2014STOMP messages with malicious SpEL expressions in selector headers\u2014cannot be received by this version.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-5421",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-asm@3.0.5.RELEASE-tuxcare.12"
        }
      ],
      "bom-ref": "urn:uuid:b07e7be7-c02f-5fd1-bcc8-785f988abfda",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2020-5421 affects version 3.0.5.RELEASE-tuxcare.12 of org.springframework:spring-asm."
      }
    },
    {
      "id": "CVE-2026-22740",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-asm@3.0.5.RELEASE-tuxcare.12"
        }
      ],
      "bom-ref": "urn:uuid:e3a07b8c-a61c-5506-a862-d24a6e25cf97",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-22740 affects version 3.0.5.RELEASE-tuxcare.12 of org.springframework:spring-asm."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-asm@3.0.5.RELEASE-tuxcare.12"
    }
  ]
}