{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:80a47991-6fec-507a-980d-8defa006f9ac",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-beans",
      "purl": "pkg:maven/org.springframework/spring-beans@4.3.20.RELEASE-tuxcare.2",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-beans@4.3.20.RELEASE-tuxcare.2",
      "version": "4.3.20.RELEASE-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-beans",
            "purl": "pkg:maven/org.springframework/spring-beans@4.3.20.RELEASE",
            "type": "library",
            "group": "org.springframework",
            "version": "4.3.20.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2009-1190",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-beans@4.3.20.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:fd058802-244f-5758-bc1c-2de57972df51",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2009-1190 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-beans."
      }
    },
    {
      "id": "CVE-2011-2730",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-beans@4.3.20.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:a1064a99-56a2-559d-852e-7a04efaac621",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2011-2730 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-beans."
      }
    },
    {
      "id": "CVE-2011-2894",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-beans@4.3.20.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:46c80f84-a5e1-596d-aa21-e81851e4eb0c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2011-2894 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-beans."
      }
    },
    {
      "id": "CVE-2014-3578",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-beans@4.3.20.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:451df74c-2aa2-5408-9004-7c25abb85d2b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2014-3578 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-beans."
      }
    },
    {
      "id": "CVE-2015-0201",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-beans@4.3.20.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:d9186e40-2d57-5c30-88f5-3db92176e140",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2015-0201 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-beans."
      }
    },
    {
      "id": "CVE-2015-5211",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-beans@4.3.20.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:a610704a-3b2c-5390-a619-d655d6ff0304",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2015-5211 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-beans."
      }
    },
    {
      "id": "CVE-2016-5007",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-beans@4.3.20.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:5be8b025-3586-5c4a-a283-be653e29ca3f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2016-5007 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-beans."
      }
    },
    {
      "id": "CVE-2018-11040",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-beans@4.3.20.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:461c5045-3271-56be-91ee-11065aa5b66e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-11040 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-beans."
      }
    },
    {
      "id": "CVE-2018-1199",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-beans@4.3.20.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:81908980-de2b-5813-81c7-54971dd2a6df",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1199 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-beans."
      }
    },
    {
      "id": "CVE-2018-1257",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-beans@4.3.20.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:611d160c-c926-518a-9253-72902c936dea",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1257 does not affect version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-beans. not_affected \u2014 Target version 4.3.20.RELEASE is not affected by CVE-2018-1257. The vulnerability (regex DoS via malicious SpEL expressions in STOMP selector headers) was fixed by upstream Spring Framework in version 4.3.17 through two defensive measures: (1) switching from StandardEvaluationContext to SimpleEvaluationContext to restrict expression capabilities, and (2) adding configuration support to disable ...",
        "justification": "protected_at_runtime"
      }
    },
    {
      "id": "CVE-2018-1258",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-beans@4.3.20.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:e4f4ca10-824a-52b4-aeef-8f7ad8ca277e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1258 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-beans."
      }
    },
    {
      "id": "CVE-2018-1271",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-beans@4.3.20.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:ef18b93d-a762-5cc6-9ff7-7d7f40193e8a",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1271 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-beans."
      }
    },
    {
      "id": "CVE-2018-1272",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-beans@4.3.20.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:5d4f5786-65c0-58b6-aed0-0c11c92a8cd2",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1272 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-beans."
      }
    },
    {
      "id": "CVE-2018-15756",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-beans@4.3.20.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:e886eb97-dd46-5cd1-ad90-bd36237fd1a4",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-15756 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-beans."
      }
    },
    {
      "id": "CVE-2021-22060",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-beans@4.3.20.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:e772a8e8-5d08-59b4-8094-26d2ecc34b90",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-22060 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-beans."
      }
    },
    {
      "id": "CVE-2021-22096",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-beans@4.3.20.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:2bef98ad-496d-54e4-9f5e-8ec63b2984e6",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2021-22096 is fixed in version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-beans."
      }
    },
    {
      "id": "CVE-2022-22965",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-beans@4.3.20.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:05d9a5e2-847d-55c6-9475-d110d051add4",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-beans."
      }
    },
    {
      "id": "CVE-2022-22970",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-beans@4.3.20.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:ccd3e7ce-401f-5a99-989e-fa96461e49a4",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-22970 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-beans."
      }
    },
    {
      "id": "CVE-2024-22233",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-beans@4.3.20.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:df3dae9e-1f3b-58a3-8824-3c91efb873ec",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-22233 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-beans."
      }
    },
    {
      "id": "CVE-2025-41249",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-beans@4.3.20.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:f66fc872-b633-58e0-8c0a-35204e072ca5",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-41249 is fixed in version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-beans."
      }
    },
    {
      "id": "CVE-2026-41848",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-beans@4.3.20.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:a541a77a-9cc3-5bc3-ad74-ba87e016c16f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41848 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-beans."
      }
    },
    {
      "id": "CVE-2026-59282",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-beans@4.3.20.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:99455bf6-b027-53ca-a92e-b6ffea2bd23f",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59282 is fixed in version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-beans."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-beans@4.3.20.RELEASE-tuxcare.2"
    }
  ]
}