{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:6dd315f7-00eb-513c-b274-6f61719f6c46",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-context",
      "purl": "pkg:maven/org.springframework/spring-context@5.3.5-tuxcare.1",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-context@5.3.5-tuxcare.1",
      "version": "5.3.5-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-context",
            "purl": "pkg:maven/org.springframework/spring-context@5.3.5",
            "type": "library",
            "group": "org.springframework",
            "version": "5.3.5"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2009-1190",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:1544869a-4824-5ab2-9b2a-23661fc00cad",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2009-1190 affects version 5.3.5-tuxcare.1 of org.springframework:spring-context."
      }
    },
    {
      "id": "CVE-2011-2730",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:2f1c613d-1455-5af4-9911-0db089c8a242",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2011-2730 affects version 5.3.5-tuxcare.1 of org.springframework:spring-context."
      }
    },
    {
      "id": "CVE-2011-2894",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:562947f1-2572-57eb-84c9-7c71095dff36",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2011-2894 affects version 5.3.5-tuxcare.1 of org.springframework:spring-context."
      }
    },
    {
      "id": "CVE-2014-3578",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:4e0cfcd2-5491-5408-9ccd-e527492db45a",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2014-3578 affects version 5.3.5-tuxcare.1 of org.springframework:spring-context."
      }
    },
    {
      "id": "CVE-2015-0201",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:54f5e734-5071-548f-9228-ebf8a8183676",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2015-0201 affects version 5.3.5-tuxcare.1 of org.springframework:spring-context."
      }
    },
    {
      "id": "CVE-2015-5211",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:01a7fb4b-8d2e-5d6d-80ec-07f429369552",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2015-5211 affects version 5.3.5-tuxcare.1 of org.springframework:spring-context."
      }
    },
    {
      "id": "CVE-2016-5007",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:9777cee2-4967-5d6f-94a2-1c26394a1440",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2016-5007 affects version 5.3.5-tuxcare.1 of org.springframework:spring-context."
      }
    },
    {
      "id": "CVE-2018-11040",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:adcb8bf1-99c1-5b98-a79b-b41b47c42651",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-11040 affects version 5.3.5-tuxcare.1 of org.springframework:spring-context."
      }
    },
    {
      "id": "CVE-2018-1199",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:2d861ebc-7135-5d50-a9b9-2bcea0c9d9c0",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1199 affects version 5.3.5-tuxcare.1 of org.springframework:spring-context."
      }
    },
    {
      "id": "CVE-2018-1257",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:d899a040-6e88-5215-85c7-d92e6bb4362c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1257 does not affect version 5.3.5-tuxcare.1 of org.springframework:spring-context. not_affected \u2014 CVE-2018-1257 is NOT present in Spring Framework 5.3.5. The vulnerability involved unguarded Spring EL expression parsing of user-controlled selector headers in STOMP messaging, which could lead to ReDoS attacks. The upstream fix (adding null-check guards and the ability to disable the selector feature) was applied in April 2018 and shipped in the upstream Spring Framework 5.3.5 release that Tu...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1258",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:a888e46e-053f-5637-b7f1-938b53811a09",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1258 affects version 5.3.5-tuxcare.1 of org.springframework:spring-context."
      }
    },
    {
      "id": "CVE-2018-1271",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:190009d7-c0f3-5e0c-82dc-f3af74930311",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1271 affects version 5.3.5-tuxcare.1 of org.springframework:spring-context."
      }
    },
    {
      "id": "CVE-2018-1272",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:2c837c90-1e05-5756-9bb9-52e455933c63",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1272 affects version 5.3.5-tuxcare.1 of org.springframework:spring-context."
      }
    },
    {
      "id": "CVE-2018-15756",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:5c1a5d51-926a-59f3-b03b-4e2b44e9c032",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-15756 affects version 5.3.5-tuxcare.1 of org.springframework:spring-context."
      }
    },
    {
      "id": "CVE-2021-22060",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:76b91e8c-74c9-53c4-ae7c-368543118b4a",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-22060 affects version 5.3.5-tuxcare.1 of org.springframework:spring-context."
      }
    },
    {
      "id": "CVE-2021-22096",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:61a38665-e89c-5159-bf7f-cb56d6b520ad",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-22096 affects version 5.3.5-tuxcare.1 of org.springframework:spring-context."
      }
    },
    {
      "id": "CVE-2022-22950",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:1f9409c4-e94e-5ed5-9f78-ef878180c43f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-22950 affects version 5.3.5-tuxcare.1 of org.springframework:spring-context."
      }
    },
    {
      "id": "CVE-2022-22965",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:aa4f829c-1f69-5dae-8a31-c5f8c1d12eb0",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.3.5-tuxcare.1 of org.springframework:spring-context."
      }
    },
    {
      "id": "CVE-2022-22968",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:cf7f3adc-2a97-568c-9751-8f365b70468e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-22968 affects version 5.3.5-tuxcare.1 of org.springframework:spring-context, and is fixed in 5.3.5-tuxcare.2."
      }
    },
    {
      "id": "CVE-2022-22970",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:b437cbaf-416c-545e-9dc1-d6716439bd89",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-22970 affects version 5.3.5-tuxcare.1 of org.springframework:spring-context."
      }
    },
    {
      "id": "CVE-2023-20861",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:01ba61fe-9dd3-5549-b372-c84ae4ca58c6",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-20861 affects version 5.3.5-tuxcare.1 of org.springframework:spring-context."
      }
    },
    {
      "id": "CVE-2023-20863",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:871c0414-9421-50c1-9b29-c31810bf9118",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2023-20863 is fixed in version 5.3.5-tuxcare.1 of org.springframework:spring-context."
      }
    },
    {
      "id": "CVE-2024-22233",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:59d50a39-c8f6-5bf5-88d7-52085f181008",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-22233 affects version 5.3.5-tuxcare.1 of org.springframework:spring-context."
      }
    },
    {
      "id": "CVE-2024-38808",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:9fdfd5a1-18d3-534f-b399-510ed36efe37",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-38808 affects version 5.3.5-tuxcare.1 of org.springframework:spring-context."
      }
    },
    {
      "id": "CVE-2024-38820",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:ce3e46aa-7b69-5d62-a207-0d79c0121cbd",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-38820 does not affect version 5.3.5-tuxcare.1 of org.springframework:spring-context. not_affected \u2014 Version 5.3.5 is NOT AFFECTED by CVE-2024-38820. This vulnerability specifically addresses a flaw in the case-insensitive field matching implementation introduced by the CVE-2022-22968 fix, which used toLowerCase() without Locale.ROOT. Version 5.3.5 predates the CVE-2022-22968 fix and contains no toLowerCase() operations in DataBinder. The vulnerable code pattern (locale-dependent case normaliz...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-22233",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:e1a6a36d-37e9-5500-973a-f4fbd84295ed",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-22233 affects version 5.3.5-tuxcare.1 of org.springframework:spring-context."
      }
    },
    {
      "id": "CVE-2025-41249",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:46a13273-0a00-5eb6-b5e0-23c88ce0db5c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-41249 affects version 5.3.5-tuxcare.1 of org.springframework:spring-context."
      }
    },
    {
      "id": "CVE-2026-41848",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:135a7f3c-f615-5927-b202-419a592e0745",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41848 affects version 5.3.5-tuxcare.1 of org.springframework:spring-context."
      }
    },
    {
      "id": "CVE-2026-41849",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:4991ca67-f529-589d-8e10-76cb166ded9f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41849 affects version 5.3.5-tuxcare.1 of org.springframework:spring-context."
      }
    },
    {
      "id": "CVE-2026-41850",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:79fcd3c6-9f08-534e-b035-30051efbeb72",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41850 affects version 5.3.5-tuxcare.1 of org.springframework:spring-context."
      }
    },
    {
      "id": "CVE-2026-41851",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:ffa9edb9-0c49-5281-bb94-8d5f5fd86f2b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41851 affects version 5.3.5-tuxcare.1 of org.springframework:spring-context."
      }
    },
    {
      "id": "CVE-2026-41852",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:548b69e4-442b-5f4b-a21f-0bab8ae7fe48",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.5-tuxcare.1 of org.springframework:spring-context."
      }
    },
    {
      "id": "CVE-2026-47886",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:9aff2c6d-027c-5925-bb69-b746367cdba8",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.5-tuxcare.1 of org.springframework:spring-context."
      }
    },
    {
      "id": "CVE-2026-59282",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:08430f2f-0f2a-5112-a645-e6e27b4f88ef",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.5-tuxcare.1 of org.springframework:spring-context."
      }
    },
    {
      "id": "CVE-2026-59283",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:a5bd9074-cab7-517e-be9a-de42c10aee10",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.5-tuxcare.1 of org.springframework:spring-context."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-context@5.3.5-tuxcare.1"
    }
  ]
}