{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:548c9818-aff1-50aa-ae74-0832d625e222",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-context-support",
      "purl": "pkg:maven/org.springframework/spring-context-support@5.3.32-tuxcare.1",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-context-support@5.3.32-tuxcare.1",
      "version": "5.3.32-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-context-support",
            "purl": "pkg:maven/org.springframework/spring-context-support@5.3.32",
            "type": "library",
            "group": "org.springframework",
            "version": "5.3.32"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2009-1190",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context-support@5.3.32-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:27bdb71d-b190-522a-b8db-79f84bdbf837",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2009-1190 affects version 5.3.32-tuxcare.1 of org.springframework:spring-context-support."
      }
    },
    {
      "id": "CVE-2011-2730",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context-support@5.3.32-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:993e7f6f-d0e2-5907-819a-9f5d60e60411",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2011-2730 affects version 5.3.32-tuxcare.1 of org.springframework:spring-context-support."
      }
    },
    {
      "id": "CVE-2011-2894",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context-support@5.3.32-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:dd817eaa-ac90-597e-affa-7540fca5a3e1",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2011-2894 affects version 5.3.32-tuxcare.1 of org.springframework:spring-context-support."
      }
    },
    {
      "id": "CVE-2014-3578",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context-support@5.3.32-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:3d5ecea9-3c8e-5590-9404-de9c8d7beaaf",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2014-3578 affects version 5.3.32-tuxcare.1 of org.springframework:spring-context-support."
      }
    },
    {
      "id": "CVE-2015-0201",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context-support@5.3.32-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:98c97b42-babd-5bcc-a13b-ad903af0c045",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2015-0201 affects version 5.3.32-tuxcare.1 of org.springframework:spring-context-support."
      }
    },
    {
      "id": "CVE-2015-5211",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context-support@5.3.32-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:d1ecef6c-2aa0-5475-8bbc-e1072f5c1632",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2015-5211 affects version 5.3.32-tuxcare.1 of org.springframework:spring-context-support."
      }
    },
    {
      "id": "CVE-2016-5007",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context-support@5.3.32-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:308d997e-07ef-590c-81e9-e42602da84ea",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2016-5007 affects version 5.3.32-tuxcare.1 of org.springframework:spring-context-support."
      }
    },
    {
      "id": "CVE-2018-11040",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context-support@5.3.32-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:ed81e855-7282-5882-84f8-11075e7a0033",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-11040 affects version 5.3.32-tuxcare.1 of org.springframework:spring-context-support."
      }
    },
    {
      "id": "CVE-2018-1199",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context-support@5.3.32-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:6ee8575c-a1e1-5bab-a352-6402b8f36d2a",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1199 affects version 5.3.32-tuxcare.1 of org.springframework:spring-context-support."
      }
    },
    {
      "id": "CVE-2018-1257",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context-support@5.3.32-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:fee8776f-1884-5ca1-a745-b41caa00208a",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1257 does not affect version 5.3.32-tuxcare.1 of org.springframework:spring-context-support. not_affected \u2014 The target Spring Framework 5.3.32 is NOT affected by CVE-2018-1257 (STOMP selector ReDoS vulnerability). The upstream vendor fix was already present in the 5.3.32 release that TuxCare onboarded. The fix adds a null-check guard around selector expression parsing in DefaultSubscriptionRegistry.getSelectorExpression() (lines 162-164), allowing the selector feature to be disabled entirely by setti...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1258",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context-support@5.3.32-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:2376898c-3bea-5803-b094-da40a183fbb0",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1258 affects version 5.3.32-tuxcare.1 of org.springframework:spring-context-support."
      }
    },
    {
      "id": "CVE-2018-1271",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context-support@5.3.32-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:0715c567-17a8-50e6-b177-5d367e94c03a",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1271 affects version 5.3.32-tuxcare.1 of org.springframework:spring-context-support."
      }
    },
    {
      "id": "CVE-2018-1272",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context-support@5.3.32-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:3453344f-ec33-5a24-ae54-e6ec4585f0b5",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1272 affects version 5.3.32-tuxcare.1 of org.springframework:spring-context-support."
      }
    },
    {
      "id": "CVE-2018-15756",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context-support@5.3.32-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:32f181be-e37d-50d1-87b9-9334bf51c84d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-15756 affects version 5.3.32-tuxcare.1 of org.springframework:spring-context-support."
      }
    },
    {
      "id": "CVE-2021-22060",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context-support@5.3.32-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:1a6c56a7-eace-5c77-89d2-2768572618e9",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-22060 affects version 5.3.32-tuxcare.1 of org.springframework:spring-context-support."
      }
    },
    {
      "id": "CVE-2021-22096",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context-support@5.3.32-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:334f97d3-56f6-50f9-8d88-c2283b8e62d4",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-22096 affects version 5.3.32-tuxcare.1 of org.springframework:spring-context-support."
      }
    },
    {
      "id": "CVE-2022-22950",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context-support@5.3.32-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:cd97e0ab-3b07-5fcf-aefe-db3c1f06c150",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-22950 affects version 5.3.32-tuxcare.1 of org.springframework:spring-context-support."
      }
    },
    {
      "id": "CVE-2022-22965",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context-support@5.3.32-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:63aee46d-4192-53e2-8788-c8449ff5aa1b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22965 does not affect version 5.3.32-tuxcare.1 of org.springframework:spring-context-support. Spring Framework 5.3.32 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22968",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context-support@5.3.32-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:456411d5-b4af-5047-97c1-d96be7a08cca",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-22968 affects version 5.3.32-tuxcare.1 of org.springframework:spring-context-support."
      }
    },
    {
      "id": "CVE-2022-22970",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context-support@5.3.32-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:a1f67750-52b0-5ec2-88c0-5f937a77598c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22970 does not affect version 5.3.32-tuxcare.1 of org.springframework:spring-context-support. not_affected \u2014 CVE-2022-22970 fix was already present in the upstream Spring Framework 5.3.32 release. The vulnerability affects applications handling file uploads with data binding to MultipartFile/Part fields, allowing DoS through repeated access to expensive read-only property getters. The fix (commit 83186b689f, May 2022) filters AutoCloseable, ClassLoader, and ProtectionDomain read-only properties during...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-20861",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context-support@5.3.32-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:173b1049-2090-54f7-b04a-a19bb7ebed5a",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-20861 affects version 5.3.32-tuxcare.1 of org.springframework:spring-context-support."
      }
    },
    {
      "id": "CVE-2023-20863",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context-support@5.3.32-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:d05ecb36-e566-5baa-9e37-84bc9e37640c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-20863 affects version 5.3.32-tuxcare.1 of org.springframework:spring-context-support."
      }
    },
    {
      "id": "CVE-2024-22233",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context-support@5.3.32-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:8c917980-1e02-5b35-b8b1-f9de62adf5ae",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-22233 affects version 5.3.32-tuxcare.1 of org.springframework:spring-context-support."
      }
    },
    {
      "id": "CVE-2024-38808",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context-support@5.3.32-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:8a24abaf-e8c6-5ddb-8c94-cebfb425d910",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-38808 affects version 5.3.32-tuxcare.1 of org.springframework:spring-context-support."
      }
    },
    {
      "id": "CVE-2024-38820",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context-support@5.3.32-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:3cbcc7a1-8d99-5e99-ba0a-4c0c434b706e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-38820 affects version 5.3.32-tuxcare.1 of org.springframework:spring-context-support."
      }
    },
    {
      "id": "CVE-2025-22233",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context-support@5.3.32-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:c12db5c8-b0ae-58c6-a0ed-23223b3fb1cf",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-22233 affects version 5.3.32-tuxcare.1 of org.springframework:spring-context-support."
      }
    },
    {
      "id": "CVE-2025-41249",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context-support@5.3.32-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:23f86102-a5d8-5fe5-9e8c-3c07a373eb81",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-41249 affects version 5.3.32-tuxcare.1 of org.springframework:spring-context-support."
      }
    },
    {
      "id": "CVE-2026-41848",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context-support@5.3.32-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:618373fc-30b1-5709-aad4-c25032fa9f6c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41848 affects version 5.3.32-tuxcare.1 of org.springframework:spring-context-support, and is fixed in 5.3.32-tuxcare.2."
      }
    },
    {
      "id": "CVE-2026-41849",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context-support@5.3.32-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:e47e3ffc-c6de-5e9c-a82c-04e42406643c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41849 affects version 5.3.32-tuxcare.1 of org.springframework:spring-context-support."
      }
    },
    {
      "id": "CVE-2026-41850",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context-support@5.3.32-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:e5a951ad-63dd-53f2-bb82-ba3ef007af7a",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41850 affects version 5.3.32-tuxcare.1 of org.springframework:spring-context-support, and is fixed in 5.3.32-tuxcare.3."
      }
    },
    {
      "id": "CVE-2026-41851",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context-support@5.3.32-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:7466f7b5-d471-55cb-befd-cc9e2529ac8d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41851 affects version 5.3.32-tuxcare.1 of org.springframework:spring-context-support, and is fixed in 5.3.32-tuxcare.2."
      }
    },
    {
      "id": "CVE-2026-41852",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context-support@5.3.32-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:f077c8fc-623a-5108-9b3c-316440c5ede0",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.32-tuxcare.1 of org.springframework:spring-context-support."
      }
    },
    {
      "id": "CVE-2026-47886",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context-support@5.3.32-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:b32b954e-9a0b-5a79-b16f-39f05d6dc254",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.32-tuxcare.1 of org.springframework:spring-context-support."
      }
    },
    {
      "id": "CVE-2026-59280",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context-support@5.3.32-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:f6774662-ab25-5dd6-a4f5-ff51eedac2b7",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.32-tuxcare.1 of org.springframework:spring-context-support."
      }
    },
    {
      "id": "CVE-2026-59282",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context-support@5.3.32-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:0f7fd5e5-8845-58a4-9a38-24085891cc98",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.32-tuxcare.1 of org.springframework:spring-context-support."
      }
    },
    {
      "id": "CVE-2026-59283",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context-support@5.3.32-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:08a120a5-5518-59d6-8a38-a6c6d135c156",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.32-tuxcare.1 of org.springframework:spring-context-support."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-context-support@5.3.32-tuxcare.1"
    }
  ]
}