{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:378d4f4a-41a0-5daf-a48e-435e7d079770",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-oxm",
      "purl": "pkg:maven/org.springframework/spring-oxm@4.3.5.RELEASE-tuxcare.1",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-oxm@4.3.5.RELEASE-tuxcare.1",
      "version": "4.3.5.RELEASE-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-oxm",
            "purl": "pkg:maven/org.springframework/spring-oxm@4.3.5.RELEASE",
            "type": "library",
            "group": "org.springframework",
            "version": "4.3.5.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2009-1190",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@4.3.5.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:cab797be-3df1-584d-9cfc-7f81e4d67783",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2009-1190 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-oxm."
      }
    },
    {
      "id": "CVE-2011-2730",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@4.3.5.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:acfb16e1-0a06-58f1-b560-00f66be8419b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2011-2730 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-oxm."
      }
    },
    {
      "id": "CVE-2011-2894",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@4.3.5.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:c1da266d-1b12-5c8d-a6c0-c8f4bcea589a",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2011-2894 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-oxm."
      }
    },
    {
      "id": "CVE-2013-4152",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@4.3.5.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:4719d226-1e37-55b5-93c3-92be6ccd794f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2013-4152 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-oxm."
      }
    },
    {
      "id": "CVE-2013-7315",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@4.3.5.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:6ef5c358-9520-5799-9253-d9e97f690041",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2013-7315 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-oxm."
      }
    },
    {
      "id": "CVE-2014-3578",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@4.3.5.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:3140c535-4f15-5007-9a7b-13c24a15b621",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2014-3578 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-oxm."
      }
    },
    {
      "id": "CVE-2015-0201",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@4.3.5.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:4637abc6-5d7a-551a-8bcf-e6f1b03bede7",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2015-0201 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-oxm."
      }
    },
    {
      "id": "CVE-2015-5211",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@4.3.5.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:ecebb3bd-3c94-5715-a1d1-b1c22e0c1107",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2015-5211 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-oxm."
      }
    },
    {
      "id": "CVE-2016-5007",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@4.3.5.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:8b52a086-1878-5c6e-a1e9-f4a7f3a21213",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2016-5007 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-oxm."
      }
    },
    {
      "id": "CVE-2018-11040",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@4.3.5.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:76f7d7e1-8af3-522e-8226-bb2f1e4e022c",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2018-11040 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-oxm."
      }
    },
    {
      "id": "CVE-2018-1199",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@4.3.5.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:9a3e74cf-91e3-5949-b7ef-a7042cb1aeb0",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1199 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-oxm."
      }
    },
    {
      "id": "CVE-2018-1257",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@4.3.5.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:1e3dc986-b19e-588d-923d-ad95f8d0af50",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2018-1257 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-oxm."
      }
    },
    {
      "id": "CVE-2018-1258",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@4.3.5.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:ad301cf8-fa9e-558f-bf26-877c4370c43c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1258 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-oxm."
      }
    },
    {
      "id": "CVE-2018-1271",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@4.3.5.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:5ebeff4d-ff5e-5327-a645-2fbf8388e451",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2018-1271 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-oxm."
      }
    },
    {
      "id": "CVE-2018-1272",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@4.3.5.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:dd5aa3b0-16e1-54c0-b01d-51e51ecf76c9",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2018-1272 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-oxm."
      }
    },
    {
      "id": "CVE-2018-15756",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@4.3.5.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:77f70256-7782-5d52-a94b-61872c7d50f4",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2018-15756 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-oxm."
      }
    },
    {
      "id": "CVE-2021-22060",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@4.3.5.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:fa4a1ad9-76e3-54c0-9776-9ece87c3529c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-22060 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-oxm."
      }
    },
    {
      "id": "CVE-2021-22096",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@4.3.5.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:a78e096f-8db9-58d4-8185-fae5cdb386d7",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2021-22096 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-oxm."
      }
    },
    {
      "id": "CVE-2022-22965",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@4.3.5.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:d232d17a-7258-5536-90c5-3254b0d27f5b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-22965 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-oxm."
      }
    },
    {
      "id": "CVE-2022-22970",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@4.3.5.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:764b3f3e-d4c4-570d-9af7-ac747e81b792",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-22970 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-oxm."
      }
    },
    {
      "id": "CVE-2024-22233",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@4.3.5.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:c05d878b-aad3-57bf-bc9d-730c9b105709",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-22233 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-oxm."
      }
    },
    {
      "id": "CVE-2025-41249",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@4.3.5.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:f2800a6d-c7ce-529e-ba02-288d7fbbb106",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-41249 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-oxm."
      }
    },
    {
      "id": "CVE-2026-22740",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@4.3.5.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:52799c2c-9642-5381-9e70-6c11bae90e67",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-22740 does not affect version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-oxm. not_affected \u2014 Spring Framework 4.3.5.RELEASE is not affected by CVE-2026-22740. This vulnerability affects WebFlux reactive multipart handling introduced in Spring Framework 5.0. Version 4.3.5.RELEASE predates WebFlux entirely and uses servlet-based multipart handling via Apache Commons FileUpload, which has a completely different architecture without the reactive stream buffer cleanup issue described in the...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-41848",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@4.3.5.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:38ce5ae5-1f67-5a89-a7eb-6cab2bf10263",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41848 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-oxm."
      }
    },
    {
      "id": "CVE-2026-59282",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@4.3.5.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:880c83b0-87e6-56a9-af8c-6c9795a8e366",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59282 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-oxm."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-oxm@4.3.5.RELEASE-tuxcare.1"
    }
  ]
}