{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:07a4ec39-fce0-54d2-8e6b-7af08277d545",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-framework-bom",
      "purl": "pkg:maven/org.springframework/spring-framework-bom@4.3.25.RELEASE-tuxcare.6",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-framework-bom@4.3.25.RELEASE-tuxcare.6",
      "version": "4.3.25.RELEASE-tuxcare.6",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-framework-bom",
            "purl": "pkg:maven/org.springframework/spring-framework-bom@4.3.25.RELEASE",
            "type": "library",
            "group": "org.springframework",
            "version": "4.3.25.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2020-5421",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-framework-bom@4.3.25.RELEASE-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:296546e8-6297-5df8-b2e8-f2c0fe6934ba",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-5421 does not affect version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-framework-bom. not_affected \u2014 CVE-2020-5421 describes an RFD (Reflected File Download) protection bypass via jsessionid path parameters. The target version 4.3.25.RELEASE (released August 2019) is NOT affected because it predates the vulnerability introduction by over a year. The vulnerability was introduced in September 2020 (commit 2f75212eb6 between v4.3.28 and v4.3.29) and fixed in October 2020. The target already has t...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-22740",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-framework-bom@4.3.25.RELEASE-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:3f7f9250-dab3-55c3-a240-82c44664a58c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-22740 does not affect version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-framework-bom. not_affected \u2014 Spring Framework 4.3.25.RELEASE is not affected by CVE-2026-22740. The vulnerability exists in WebFlux reactive multipart handling (introduced in Spring 5.0), which is absent from the 4.x series. Version 4.3.x uses servlet-based synchronous multipart processing with explicit cleanup mechanisms that prevent temp file leaks.",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-framework-bom@4.3.25.RELEASE-tuxcare.6"
    }
  ]
}