{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:bad7d221-e98d-58a9-a707-9a407ec0a29d",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-orm",
      "purl": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE-tuxcare.1",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE-tuxcare.1",
      "version": "4.3.27.RELEASE-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-orm",
            "purl": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE",
            "type": "library",
            "group": "org.springframework",
            "version": "4.3.27.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2009-1190",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:3d1ad75f-6a4a-5f3f-91cf-301ed281b95e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2009-1190 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2011-2730",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:e03e683d-2b57-593a-a6b8-18ab26ec715d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2011-2730 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2011-2894",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:7d979642-2e1a-5d59-9023-2e7af6d2e74d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2011-2894 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2014-3578",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:a8f6561e-e379-5a10-a11c-f986c8aff65f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2014-3578 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2015-0201",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:189837b4-0cb2-5723-bd72-b0d4948c1f54",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2015-0201 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2015-5211",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:51bb5e95-4e4d-5d1c-a0d8-02b28154321b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2015-5211 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2016-5007",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:505d1270-3742-5f1d-a2ca-9cb7ccc9223a",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2016-5007 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2018-11040",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:fc46f5e2-174b-5ee9-b6d9-2f7ab47882dc",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-11040 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2018-1199",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:6b120b28-5bde-5c93-984a-1f9c6064f8b0",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1199 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2018-1257",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:5565e810-7a7e-5057-ac48-4e5d8081960a",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1257 does not affect version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-orm. not_affected \u2014 CVE-2018-1257 (ReDoS via STOMP selector header) is NOT present in spring-framework 4.3.27.RELEASE. The upstream fix from commit 246a6db1ca (authored by rstoyanchev@pivotal.io, April 2018) shipped in the upstream 4.3.27.RELEASE before TuxCare onboarded it. The fix adds a null check before parsing selector expressions, preventing malicious SpEL expressions from being unconditionally evaluated.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1258",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:9a822061-20e9-571b-9af1-e02456c6e45b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1258 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2018-1271",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:dda80379-0a47-53bc-8612-d45346cfd4d3",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1271 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2018-1272",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:ed2b2d5e-819c-5b2f-a3da-13cd8cd89543",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1272 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2018-15756",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:d109f2ee-c773-5c89-bc9d-56c75b5e80a0",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-15756 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2021-22060",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:bd216f04-8aa6-5529-8227-25f52ca23f4e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-22060 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2021-22096",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:e80fb460-4bcf-58f6-b41f-b72a6ed29ff8",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-22096 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2022-22965",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:7e023e60-195e-5f0f-8f57-3f372d3bc8da",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-22965 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2022-22970",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:c2eb5055-74d3-5ef1-9acf-e7b35d025f0e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-22970 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2024-22233",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:03698a2b-d314-5809-b378-843c44225e7f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-22233 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2025-41249",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:d2d6700b-17c8-5522-aaf4-cb1c08f3bea6",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-41249 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2026-22740",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:13390719-fcc3-5e79-a89e-50212e331188",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-22740 does not affect version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-orm. not_affected \u2014 Spring Framework 4.3.27.RELEASE is not affected by CVE-2026-22740. The vulnerability is specific to WebFlux reactive multipart handling components (PartGenerator, MultipartHttpMessageReader) that were introduced in Spring Framework 5.0. Version 4.3.27.RELEASE predates WebFlux entirely and uses traditional servlet-based multipart handling with a different cleanup mechanism (finally block in Disp...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-41848",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:4063acc8-c530-5f7f-b0c6-83d81dd66c60",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41848 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2026-59282",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:dddaff80-504c-54f4-a2b3-fb5548a4b980",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59282 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-orm."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-orm@4.3.27.RELEASE-tuxcare.1"
    }
  ]
}