{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:99841ee4-5933-55b6-85b5-f811255c045a",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-jdbc",
      "purl": "pkg:maven/org.springframework/spring-jdbc@6.1.16-tuxcare.6",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-jdbc@6.1.16-tuxcare.6",
      "version": "6.1.16-tuxcare.6",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-jdbc",
            "purl": "pkg:maven/org.springframework/spring-jdbc@6.1.16",
            "type": "library",
            "group": "org.springframework",
            "version": "6.1.16"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2009-1190",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.16-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:b7eab4c1-52c3-5434-ac24-29a61a0efc41",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2009-1190 affects version 6.1.16-tuxcare.6 of org.springframework:spring-jdbc."
      }
    },
    {
      "id": "CVE-2011-2730",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.16-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:8427ed1f-a984-5cba-beb7-7c18b74ad6f5",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2011-2730 affects version 6.1.16-tuxcare.6 of org.springframework:spring-jdbc."
      }
    },
    {
      "id": "CVE-2011-2894",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.16-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:767fb34d-787d-532d-84cd-7ca3da28a7cb",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2011-2894 affects version 6.1.16-tuxcare.6 of org.springframework:spring-jdbc."
      }
    },
    {
      "id": "CVE-2014-3578",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.16-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:00877cb7-98dd-52f7-8849-f4b08182687b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2014-3578 affects version 6.1.16-tuxcare.6 of org.springframework:spring-jdbc."
      }
    },
    {
      "id": "CVE-2015-0201",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.16-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:2da36047-bbd9-574c-be0d-dc2c48a64f19",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2015-0201 affects version 6.1.16-tuxcare.6 of org.springframework:spring-jdbc."
      }
    },
    {
      "id": "CVE-2015-5211",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.16-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:12ffb6fb-618f-549d-817e-603a20efe8e3",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2015-5211 affects version 6.1.16-tuxcare.6 of org.springframework:spring-jdbc."
      }
    },
    {
      "id": "CVE-2016-5007",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.16-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:8526cb4c-a21c-5b8a-ac24-be41bcaea8b2",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2016-5007 affects version 6.1.16-tuxcare.6 of org.springframework:spring-jdbc."
      }
    },
    {
      "id": "CVE-2018-11040",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.16-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:b73a4a7c-e6e0-533f-800e-2e78008426cd",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-11040 affects version 6.1.16-tuxcare.6 of org.springframework:spring-jdbc."
      }
    },
    {
      "id": "CVE-2018-1199",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.16-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:04f686e9-8921-577f-8adb-ebc626474806",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1199 affects version 6.1.16-tuxcare.6 of org.springframework:spring-jdbc."
      }
    },
    {
      "id": "CVE-2018-1257",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.16-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:8a925d3b-3d0b-5bde-820d-0f60e9ccd12d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1257 does not affect version 6.1.16-tuxcare.6 of org.springframework:spring-jdbc. not_affected \u2014 CVE-2018-1257 describes a DoS vulnerability via malicious Spring EL expressions in STOMP subscription selector headers. The target Spring Framework 6.1.16 has an upstream fix (commit 5bc80fc094 by sam@sambrannen.com, June 2023) that disables the SpEL selector feature by default. The selectorHeaderName field defaults to null, and the getSelectorExpression() method checks for null before attempti...",
        "justification": "protected_at_runtime"
      }
    },
    {
      "id": "CVE-2018-1258",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.16-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:cebd9083-692c-55b6-8147-1910fa3ff18c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1258 affects version 6.1.16-tuxcare.6 of org.springframework:spring-jdbc."
      }
    },
    {
      "id": "CVE-2018-1271",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.16-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:19b9ea24-8158-569c-9615-264f901471c6",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1271 affects version 6.1.16-tuxcare.6 of org.springframework:spring-jdbc."
      }
    },
    {
      "id": "CVE-2018-1272",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.16-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:87e0c38a-ed58-5b92-a19b-aef952f9ea9c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1272 affects version 6.1.16-tuxcare.6 of org.springframework:spring-jdbc."
      }
    },
    {
      "id": "CVE-2018-15756",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.16-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:cc44c9c8-40c0-5fa8-adaa-1442c5c99060",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-15756 affects version 6.1.16-tuxcare.6 of org.springframework:spring-jdbc."
      }
    },
    {
      "id": "CVE-2021-22060",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.16-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:5d85a1c7-4164-50e2-8d15-0ac45c01706d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-22060 affects version 6.1.16-tuxcare.6 of org.springframework:spring-jdbc."
      }
    },
    {
      "id": "CVE-2021-22096",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.16-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:14c8b745-629c-584c-92f1-2cfca8e0fc57",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-22096 affects version 6.1.16-tuxcare.6 of org.springframework:spring-jdbc."
      }
    },
    {
      "id": "CVE-2022-22965",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.16-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:df559e35-5606-5a12-86ea-d60892413909",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22965 does not affect version 6.1.16-tuxcare.6 of org.springframework:spring-jdbc. Spring Framework 6.1.16 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22970",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.16-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:85c1e0c1-4500-5b36-b47f-a8dadf86c08d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22970 does not affect version 6.1.16-tuxcare.6 of org.springframework:spring-jdbc. not_affected \u2014 CVE-2022-22970 is NOT present in Spring Framework 6.1.16. The vulnerability allowed DoS attacks through file upload data binding that triggered repeated property introspection of MultipartFile/Part fields, causing resource exhaustion via unclosed InputStreams. The upstream fix (commit 83186b689f by Juergen Hoeller) blocks introspection of read-only properties returning AutoCloseable types (incl...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-22233",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.16-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:2f37222b-c69a-54f1-a667-e6fcfbb9a82c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-22233 affects version 6.1.16-tuxcare.6 of org.springframework:spring-jdbc."
      }
    },
    {
      "id": "CVE-2025-41249",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.16-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:3004e830-fd8c-5142-9577-2c4ea68ee2b7",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.1.16-tuxcare.6 of org.springframework:spring-jdbc."
      }
    },
    {
      "id": "CVE-2026-41848",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.16-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:562815a0-d9ad-5cc6-a9ac-59622ff5fc6e",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.1.16-tuxcare.6 of org.springframework:spring-jdbc."
      }
    },
    {
      "id": "CVE-2026-59282",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.16-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:4d403585-5e23-5222-943c-c0e77b797d3c",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.1.16-tuxcare.6 of org.springframework:spring-jdbc."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.16-tuxcare.6"
    }
  ]
}