{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:217c028c-d3b9-5494-95b6-3f100b3982b3",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-context",
      "purl": "pkg:maven/org.springframework/spring-context@5.3.5-tuxcare.2",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-context@5.3.5-tuxcare.2",
      "version": "5.3.5-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-context",
            "purl": "pkg:maven/org.springframework/spring-context@5.3.5",
            "type": "library",
            "group": "org.springframework",
            "version": "5.3.5"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2009-1190",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.5-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:ddc49236-09fe-579e-a69b-bcd8b01806a0",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2009-1190 affects version 5.3.5-tuxcare.2 of org.springframework:spring-context."
      }
    },
    {
      "id": "CVE-2011-2730",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.5-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:47f796cd-8cbb-51ae-b414-61a3bfb21afb",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2011-2730 affects version 5.3.5-tuxcare.2 of org.springframework:spring-context."
      }
    },
    {
      "id": "CVE-2011-2894",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.5-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:eb9df2cf-3b8b-5d3a-a8fe-cf69ad87a557",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2011-2894 affects version 5.3.5-tuxcare.2 of org.springframework:spring-context."
      }
    },
    {
      "id": "CVE-2014-3578",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.5-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:1ada2d18-4121-5710-9878-eb6ea91c8e94",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2014-3578 affects version 5.3.5-tuxcare.2 of org.springframework:spring-context."
      }
    },
    {
      "id": "CVE-2015-0201",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.5-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:9a823bf6-d969-599f-91c2-b1025a02c547",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2015-0201 affects version 5.3.5-tuxcare.2 of org.springframework:spring-context."
      }
    },
    {
      "id": "CVE-2015-5211",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.5-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:e3d6c568-3d7a-579b-91b2-bd8ab0822f7c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2015-5211 affects version 5.3.5-tuxcare.2 of org.springframework:spring-context."
      }
    },
    {
      "id": "CVE-2016-5007",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.5-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:8791d127-b013-5647-a599-e858d8945394",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2016-5007 affects version 5.3.5-tuxcare.2 of org.springframework:spring-context."
      }
    },
    {
      "id": "CVE-2018-11040",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.5-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:74aede31-0c36-520d-ad64-b809a1921f29",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-11040 affects version 5.3.5-tuxcare.2 of org.springframework:spring-context."
      }
    },
    {
      "id": "CVE-2018-1199",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.5-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:12b91530-80f0-54d5-b3e5-7473c286e47c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1199 affects version 5.3.5-tuxcare.2 of org.springframework:spring-context."
      }
    },
    {
      "id": "CVE-2018-1257",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.5-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:f3fb6012-3799-508d-a4f4-d74f9d3d51aa",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1257 does not affect version 5.3.5-tuxcare.2 of org.springframework:spring-context. not_affected \u2014 CVE-2018-1257 is NOT present in Spring Framework 5.3.5. The vulnerability involved unguarded Spring EL expression parsing of user-controlled selector headers in STOMP messaging, which could lead to ReDoS attacks. The upstream fix (adding null-check guards and the ability to disable the selector feature) was applied in April 2018 and shipped in the upstream Spring Framework 5.3.5 release that Tu...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1258",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.5-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:d93791da-49ef-5225-8984-1b1e82d34c06",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1258 affects version 5.3.5-tuxcare.2 of org.springframework:spring-context."
      }
    },
    {
      "id": "CVE-2018-1271",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.5-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:7439bb39-f61a-5558-89c5-e33861fa7615",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1271 affects version 5.3.5-tuxcare.2 of org.springframework:spring-context."
      }
    },
    {
      "id": "CVE-2018-1272",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.5-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:413b28d1-a5e0-5b24-a526-b68d1f3f59e6",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1272 affects version 5.3.5-tuxcare.2 of org.springframework:spring-context."
      }
    },
    {
      "id": "CVE-2018-15756",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.5-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:ec4cbe55-d415-5719-8e29-f3acc5f1650c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-15756 affects version 5.3.5-tuxcare.2 of org.springframework:spring-context."
      }
    },
    {
      "id": "CVE-2021-22060",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.5-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:6a5fe5c2-8501-581a-8379-e897fa510c94",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-22060 affects version 5.3.5-tuxcare.2 of org.springframework:spring-context."
      }
    },
    {
      "id": "CVE-2021-22096",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.5-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:e0d5b4ea-2646-5a0b-b0d1-7f7e2f90d4ac",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-22096 affects version 5.3.5-tuxcare.2 of org.springframework:spring-context."
      }
    },
    {
      "id": "CVE-2022-22950",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.5-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:ec3b18ca-e1e6-57fc-9961-43a5007c2f03",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-22950 affects version 5.3.5-tuxcare.2 of org.springframework:spring-context."
      }
    },
    {
      "id": "CVE-2022-22965",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.5-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:d11d1b43-9bac-5e9d-94b6-b30011dd63e7",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.3.5-tuxcare.2 of org.springframework:spring-context."
      }
    },
    {
      "id": "CVE-2022-22968",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.5-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:006a26d6-b806-539d-8468-035a3b6da408",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-22968 is fixed in version 5.3.5-tuxcare.2 of org.springframework:spring-context."
      }
    },
    {
      "id": "CVE-2022-22970",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.5-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:f9e7fa40-5fbf-52a3-83ed-585e9fb17a39",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-22970 affects version 5.3.5-tuxcare.2 of org.springframework:spring-context."
      }
    },
    {
      "id": "CVE-2023-20861",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.5-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:5c5a358f-30f1-5b44-a594-87315d096b58",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-20861 affects version 5.3.5-tuxcare.2 of org.springframework:spring-context."
      }
    },
    {
      "id": "CVE-2023-20863",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.5-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:8b1a1edc-2edb-5862-a9a8-2871c2eecc36",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2023-20863 is fixed in version 5.3.5-tuxcare.2 of org.springframework:spring-context."
      }
    },
    {
      "id": "CVE-2024-22233",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.5-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:56230e7e-2449-5052-967d-df7ba54f926f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-22233 affects version 5.3.5-tuxcare.2 of org.springframework:spring-context."
      }
    },
    {
      "id": "CVE-2024-38808",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.5-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:0eb777ec-9258-560d-ae32-90e496071767",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-38808 affects version 5.3.5-tuxcare.2 of org.springframework:spring-context."
      }
    },
    {
      "id": "CVE-2024-38820",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.5-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:989be776-9ef3-5c54-a914-af4b293ffc71",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-38820 does not affect version 5.3.5-tuxcare.2 of org.springframework:spring-context. not_affected \u2014 Version 5.3.5 is NOT AFFECTED by CVE-2024-38820. This vulnerability specifically addresses a flaw in the case-insensitive field matching implementation introduced by the CVE-2022-22968 fix, which used toLowerCase() without Locale.ROOT. Version 5.3.5 predates the CVE-2022-22968 fix and contains no toLowerCase() operations in DataBinder. The vulnerable code pattern (locale-dependent case normaliz...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-22233",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.5-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:1920b0fd-17b6-575b-851b-bbbc4e04b812",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-22233 affects version 5.3.5-tuxcare.2 of org.springframework:spring-context."
      }
    },
    {
      "id": "CVE-2025-41249",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.5-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:4e28bbfc-c3ed-5629-b229-e0160ea22676",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-41249 affects version 5.3.5-tuxcare.2 of org.springframework:spring-context."
      }
    },
    {
      "id": "CVE-2026-41848",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.5-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:9caebd70-e145-520f-9738-9acabbed9429",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41848 affects version 5.3.5-tuxcare.2 of org.springframework:spring-context."
      }
    },
    {
      "id": "CVE-2026-41849",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.5-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:13a1fc83-3a71-5976-967c-9b8b87fee043",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41849 affects version 5.3.5-tuxcare.2 of org.springframework:spring-context."
      }
    },
    {
      "id": "CVE-2026-41850",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.5-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:ff025667-84cc-5f11-b308-fb1769b7b209",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41850 affects version 5.3.5-tuxcare.2 of org.springframework:spring-context."
      }
    },
    {
      "id": "CVE-2026-41851",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.5-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:c58eae34-4f0d-54b1-a534-692eadd2479d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41851 affects version 5.3.5-tuxcare.2 of org.springframework:spring-context."
      }
    },
    {
      "id": "CVE-2026-41852",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.5-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:f72bb9a7-f1a7-53bf-8bbe-943c859e2a75",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.5-tuxcare.2 of org.springframework:spring-context."
      }
    },
    {
      "id": "CVE-2026-47886",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.5-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:a9e4e3e7-43d6-5502-a0ce-36a93aa640dd",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.5-tuxcare.2 of org.springframework:spring-context."
      }
    },
    {
      "id": "CVE-2026-59282",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.5-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:60a79cb0-179e-55f1-b69c-c8939dfe2b2a",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.5-tuxcare.2 of org.springframework:spring-context."
      }
    },
    {
      "id": "CVE-2026-59283",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.5-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:78bb94b6-083d-54ac-aacf-1b494650df3e",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.5-tuxcare.2 of org.springframework:spring-context."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-context@5.3.5-tuxcare.2"
    }
  ]
}