{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:0b2bdff6-f142-5615-8ab0-dc73feb92637",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-jdbc",
      "purl": "pkg:maven/org.springframework/spring-jdbc@4.3.5.RELEASE-tuxcare.1",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-jdbc@4.3.5.RELEASE-tuxcare.1",
      "version": "4.3.5.RELEASE-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-jdbc",
            "purl": "pkg:maven/org.springframework/spring-jdbc@4.3.5.RELEASE",
            "type": "library",
            "group": "org.springframework",
            "version": "4.3.5.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2009-1190",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-jdbc@4.3.5.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:b75dae10-3f37-50b2-945e-007defe79065",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2009-1190 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-jdbc."
      }
    },
    {
      "id": "CVE-2011-2730",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-jdbc@4.3.5.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:7f80a814-81d2-5fff-a636-1456cb79e6aa",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2011-2730 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-jdbc."
      }
    },
    {
      "id": "CVE-2011-2894",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-jdbc@4.3.5.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:8e4889c0-7cb7-586e-a711-6c5c02f1ddc9",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2011-2894 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-jdbc."
      }
    },
    {
      "id": "CVE-2014-3578",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-jdbc@4.3.5.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:fa09774f-bfd7-56cc-8c51-76839d4ce6a6",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2014-3578 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-jdbc."
      }
    },
    {
      "id": "CVE-2015-0201",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-jdbc@4.3.5.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:3a22d0f7-31e9-508a-b832-7ec79f79def2",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2015-0201 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-jdbc."
      }
    },
    {
      "id": "CVE-2015-5211",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-jdbc@4.3.5.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:99aa6aaf-8da7-542b-8229-dc4ee4a82aa6",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2015-5211 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-jdbc."
      }
    },
    {
      "id": "CVE-2016-5007",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-jdbc@4.3.5.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:9681e1bb-5829-5ce3-b957-823e7413d7b9",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2016-5007 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-jdbc."
      }
    },
    {
      "id": "CVE-2018-11040",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-jdbc@4.3.5.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:b2c38ea1-9f8e-5f6a-8dbd-b864a532f5b4",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2018-11040 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-jdbc."
      }
    },
    {
      "id": "CVE-2018-1199",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-jdbc@4.3.5.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:7c91d0a9-20a2-50ef-9b69-0b8da37c5120",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1199 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-jdbc."
      }
    },
    {
      "id": "CVE-2018-1257",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-jdbc@4.3.5.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:fbba3e20-e1bd-5eeb-8e1f-f55ad0e061b7",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2018-1257 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-jdbc."
      }
    },
    {
      "id": "CVE-2018-1258",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-jdbc@4.3.5.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:1e1afd53-348a-5683-b27c-c63b87e333f1",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1258 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-jdbc."
      }
    },
    {
      "id": "CVE-2018-1271",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-jdbc@4.3.5.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:ab04082a-00b2-594b-b27b-fe6d1268ca19",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2018-1271 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-jdbc."
      }
    },
    {
      "id": "CVE-2018-1272",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-jdbc@4.3.5.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:0ded894f-b0bc-528b-8188-527a3cc62ff7",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2018-1272 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-jdbc."
      }
    },
    {
      "id": "CVE-2018-15756",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-jdbc@4.3.5.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:80fde04d-e563-5f01-a35c-5dea9a9ce374",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2018-15756 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-jdbc."
      }
    },
    {
      "id": "CVE-2021-22060",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-jdbc@4.3.5.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:4f5b2e5f-5cef-50de-af2b-ceaf71ba3a14",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-22060 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-jdbc."
      }
    },
    {
      "id": "CVE-2021-22096",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-jdbc@4.3.5.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:25d23519-0ec8-5f43-b883-400b41fbd7e3",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2021-22096 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-jdbc."
      }
    },
    {
      "id": "CVE-2022-22965",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-jdbc@4.3.5.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:439a6196-f4c4-5f33-9c25-54fb9dca0862",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-22965 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-jdbc."
      }
    },
    {
      "id": "CVE-2022-22970",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-jdbc@4.3.5.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:1742720e-b67e-55a2-861c-e31fdaad2b88",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-22970 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-jdbc."
      }
    },
    {
      "id": "CVE-2024-22233",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-jdbc@4.3.5.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:75bd09bf-3ad8-5d7a-bf89-e97c7c540f17",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-22233 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-jdbc."
      }
    },
    {
      "id": "CVE-2025-41249",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-jdbc@4.3.5.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:32a8aa76-ff85-53e5-b25d-157c44ee9ff6",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-41249 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-jdbc."
      }
    },
    {
      "id": "CVE-2026-22740",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-jdbc@4.3.5.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:c06a402b-d8db-5e28-9f92-79305815ba55",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-22740 does not affect version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-jdbc. not_affected \u2014 Spring Framework 4.3.5.RELEASE is not affected by CVE-2026-22740. This vulnerability affects WebFlux reactive multipart handling introduced in Spring Framework 5.0. Version 4.3.5.RELEASE predates WebFlux entirely and uses servlet-based multipart handling via Apache Commons FileUpload, which has a completely different architecture without the reactive stream buffer cleanup issue described in the...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-41848",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-jdbc@4.3.5.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:9cb036e9-3f1b-56f7-8342-1525d3a27dac",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41848 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-jdbc."
      }
    },
    {
      "id": "CVE-2026-59282",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-jdbc@4.3.5.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:40cccbe7-7169-5414-8285-a620d99d70e2",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59282 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-jdbc."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-jdbc@4.3.5.RELEASE-tuxcare.1"
    }
  ]
}