{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:68f095d1-2d9f-51a8-9026-d261543382ff",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-beans",
      "purl": "pkg:maven/org.springframework/spring-beans@5.3.32-tuxcare.3",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-beans@5.3.32-tuxcare.3",
      "version": "5.3.32-tuxcare.3",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-beans",
            "purl": "pkg:maven/org.springframework/spring-beans@5.3.32",
            "type": "library",
            "group": "org.springframework",
            "version": "5.3.32"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2009-1190",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-beans@5.3.32-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:4b7d3c26-3536-5001-bda4-5a249a943094",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2009-1190 affects version 5.3.32-tuxcare.3 of org.springframework:spring-beans."
      }
    },
    {
      "id": "CVE-2011-2730",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-beans@5.3.32-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:28012d88-ef86-5fab-b5e2-8dfaad53f723",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2011-2730 affects version 5.3.32-tuxcare.3 of org.springframework:spring-beans."
      }
    },
    {
      "id": "CVE-2011-2894",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-beans@5.3.32-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:7b9954b0-5ce7-5476-8a77-f182346974c3",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2011-2894 affects version 5.3.32-tuxcare.3 of org.springframework:spring-beans."
      }
    },
    {
      "id": "CVE-2014-3578",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-beans@5.3.32-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:105c0cec-439b-526c-a570-0f61b6823202",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2014-3578 affects version 5.3.32-tuxcare.3 of org.springframework:spring-beans."
      }
    },
    {
      "id": "CVE-2015-0201",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-beans@5.3.32-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:50f5abc8-f864-5539-9490-50a62e4f0bf0",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2015-0201 affects version 5.3.32-tuxcare.3 of org.springframework:spring-beans."
      }
    },
    {
      "id": "CVE-2015-5211",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-beans@5.3.32-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:6afedd07-4cdf-56bf-ae72-6ffa157283ec",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2015-5211 affects version 5.3.32-tuxcare.3 of org.springframework:spring-beans."
      }
    },
    {
      "id": "CVE-2016-5007",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-beans@5.3.32-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:af1d78b4-90d3-53b7-920d-507723e88133",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2016-5007 affects version 5.3.32-tuxcare.3 of org.springframework:spring-beans."
      }
    },
    {
      "id": "CVE-2018-11040",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-beans@5.3.32-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:f2dcc284-1e8b-59ef-bb3b-1b1ec357aee1",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-11040 affects version 5.3.32-tuxcare.3 of org.springframework:spring-beans."
      }
    },
    {
      "id": "CVE-2018-1199",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-beans@5.3.32-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:87e4d9d7-3a79-5e4d-b755-7ef89383fb69",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1199 affects version 5.3.32-tuxcare.3 of org.springframework:spring-beans."
      }
    },
    {
      "id": "CVE-2018-1257",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-beans@5.3.32-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:6e2700e4-027a-5f26-be1e-ad3b620289fb",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1257 does not affect version 5.3.32-tuxcare.3 of org.springframework:spring-beans. not_affected \u2014 The target Spring Framework 5.3.32 is NOT affected by CVE-2018-1257 (STOMP selector ReDoS vulnerability). The upstream vendor fix was already present in the 5.3.32 release that TuxCare onboarded. The fix adds a null-check guard around selector expression parsing in DefaultSubscriptionRegistry.getSelectorExpression() (lines 162-164), allowing the selector feature to be disabled entirely by setti...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1258",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-beans@5.3.32-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:046ed185-e60c-5fae-b6fb-feee6cdb2f10",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1258 affects version 5.3.32-tuxcare.3 of org.springframework:spring-beans."
      }
    },
    {
      "id": "CVE-2018-1271",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-beans@5.3.32-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:e600f5d6-210c-59e0-872a-a4727a34baa6",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1271 affects version 5.3.32-tuxcare.3 of org.springframework:spring-beans."
      }
    },
    {
      "id": "CVE-2018-1272",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-beans@5.3.32-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:b201e3db-6c4a-5438-b7a1-7f701f3c3d55",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1272 affects version 5.3.32-tuxcare.3 of org.springframework:spring-beans."
      }
    },
    {
      "id": "CVE-2018-15756",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-beans@5.3.32-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:a9e789b2-7de3-5c8e-afbb-b21f9f4c8b3f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-15756 affects version 5.3.32-tuxcare.3 of org.springframework:spring-beans."
      }
    },
    {
      "id": "CVE-2021-22060",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-beans@5.3.32-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:5eb30793-20a7-56f7-8bc3-6dfdcf86b8ae",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-22060 affects version 5.3.32-tuxcare.3 of org.springframework:spring-beans."
      }
    },
    {
      "id": "CVE-2021-22096",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-beans@5.3.32-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:3bb0c028-1a16-53ad-a422-fd3885f8eeab",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-22096 affects version 5.3.32-tuxcare.3 of org.springframework:spring-beans."
      }
    },
    {
      "id": "CVE-2022-22965",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-beans@5.3.32-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:1f258114-1f45-579b-b3e4-0bfc554b8edb",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22965 does not affect version 5.3.32-tuxcare.3 of org.springframework:spring-beans. Spring Framework 5.3.32 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22970",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-beans@5.3.32-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:4e2605af-50c5-5b14-a2bf-7bb6ac712b9b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22970 does not affect version 5.3.32-tuxcare.3 of org.springframework:spring-beans. not_affected \u2014 CVE-2022-22970 fix was already present in the upstream Spring Framework 5.3.32 release. The vulnerability affects applications handling file uploads with data binding to MultipartFile/Part fields, allowing DoS through repeated access to expensive read-only property getters. The fix (commit 83186b689f, May 2022) filters AutoCloseable, ClassLoader, and ProtectionDomain read-only properties during...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-22233",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-beans@5.3.32-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:c4df2428-f79a-531b-94ba-a5e7c0145788",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-22233 affects version 5.3.32-tuxcare.3 of org.springframework:spring-beans."
      }
    },
    {
      "id": "CVE-2025-41249",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-beans@5.3.32-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:9aec666a-b85e-580e-950c-a9689ad24e2b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-41249 affects version 5.3.32-tuxcare.3 of org.springframework:spring-beans."
      }
    },
    {
      "id": "CVE-2026-41848",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-beans@5.3.32-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:77117f10-edd5-561e-beb0-2e0e798db208",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.32-tuxcare.3 of org.springframework:spring-beans."
      }
    },
    {
      "id": "CVE-2026-59282",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-beans@5.3.32-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:a9755c4d-77e2-57dd-bcd3-77df112b7a80",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.32-tuxcare.3 of org.springframework:spring-beans."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-beans@5.3.32-tuxcare.3"
    }
  ]
}