{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:ccb355b4-9736-57de-9fe5-44cb89e0e181",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-aspects",
      "purl": "pkg:maven/org.springframework/spring-aspects@4.3.16.RELEASE-tuxcare.2",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-aspects@4.3.16.RELEASE-tuxcare.2",
      "version": "4.3.16.RELEASE-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-aspects",
            "purl": "pkg:maven/org.springframework/spring-aspects@4.3.16.RELEASE",
            "type": "library",
            "group": "org.springframework",
            "version": "4.3.16.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-22740",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-aspects@4.3.16.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:42c634a0-8543-5b00-bc79-c2f50c16a1b6",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-22740 does not affect version 4.3.16.RELEASE-tuxcare.2 of org.springframework:spring-aspects. not_affected \u2014 Spring Framework 4.3.16.RELEASE is not affected by CVE-2026-22740. The vulnerability affects WebFlux reactive multipart processing, specifically the PartGenerator and MultipartHttpMessageReader classes in package org.springframework.http.codec.multipart. WebFlux was introduced in Spring Framework 5.0, and this target version (4.3.16.RELEASE from April 2017) predates WebFlux entirely. The vulner...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-aspects@4.3.16.RELEASE-tuxcare.2"
    }
  ]
}