{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:9499d416-218f-5863-9e71-1a4bb5149c81",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-test",
      "purl": "pkg:maven/org.springframework/spring-test@4.3.25.RELEASE-tuxcare.6",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-test@4.3.25.RELEASE-tuxcare.6",
      "version": "4.3.25.RELEASE-tuxcare.6",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-test",
            "purl": "pkg:maven/org.springframework/spring-test@4.3.25.RELEASE",
            "type": "library",
            "group": "org.springframework",
            "version": "4.3.25.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2009-1190",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-test@4.3.25.RELEASE-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:cfbc940e-45be-5676-83a7-b0e9718e893f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2009-1190 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-test."
      }
    },
    {
      "id": "CVE-2011-2730",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-test@4.3.25.RELEASE-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:26e538c7-7f66-5e7e-9ef6-1bfce66c0f39",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2011-2730 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-test."
      }
    },
    {
      "id": "CVE-2011-2894",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-test@4.3.25.RELEASE-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:f5fab43c-74ef-58c9-ac83-4521630ed0ec",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2011-2894 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-test."
      }
    },
    {
      "id": "CVE-2014-3578",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-test@4.3.25.RELEASE-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:8f13616b-e132-5bc7-a688-47d42891bc38",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2014-3578 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-test."
      }
    },
    {
      "id": "CVE-2015-0201",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-test@4.3.25.RELEASE-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:ce2d0faa-ba8f-54c3-bf38-12376b517dd6",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2015-0201 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-test."
      }
    },
    {
      "id": "CVE-2015-5211",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-test@4.3.25.RELEASE-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:f6d57774-78c3-517b-a874-a9bb6df3f978",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2015-5211 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-test."
      }
    },
    {
      "id": "CVE-2016-5007",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-test@4.3.25.RELEASE-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:5aa55584-1c8a-5bc2-be33-78b577e47fba",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2016-5007 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-test."
      }
    },
    {
      "id": "CVE-2018-11040",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-test@4.3.25.RELEASE-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:012626ec-2a36-5a97-b3a2-9fc8bada135d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-11040 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-test."
      }
    },
    {
      "id": "CVE-2018-1199",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-test@4.3.25.RELEASE-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:8232ef74-2353-51d4-9142-00e0ea26cdcb",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1199 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-test."
      }
    },
    {
      "id": "CVE-2018-1257",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-test@4.3.25.RELEASE-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:47f4d5ec-2e8c-5e38-8c5f-e0fc350e62f7",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1257 does not affect version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-test. not_affected \u2014 Target version 4.3.25.RELEASE already contains the upstream vendor fix for CVE-2018-1257 that shipped in Spring Framework v4.3.17.RELEASE. The fix (commit 246a6db1ca) adds a null-check guard and makes the vulnerable selector header feature configurable so administrators can disable it to prevent ReDoS attacks. The fix code is present at DefaultSubscriptionRegistry.java:154 and SimpleBrokerMessa...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1258",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-test@4.3.25.RELEASE-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:15e0bbe4-6a10-5d1b-896d-09094688e2cc",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1258 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-test."
      }
    },
    {
      "id": "CVE-2018-1271",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-test@4.3.25.RELEASE-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:4242f1e8-d8c8-5040-9696-e2d3cae27290",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1271 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-test."
      }
    },
    {
      "id": "CVE-2018-1272",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-test@4.3.25.RELEASE-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:699ae461-e51a-5c5f-a220-4fd7caf38d9f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1272 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-test."
      }
    },
    {
      "id": "CVE-2018-15756",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-test@4.3.25.RELEASE-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:127e18bc-2d7c-5def-90f7-3a6f2ce01753",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-15756 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-test."
      }
    },
    {
      "id": "CVE-2021-22060",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-test@4.3.25.RELEASE-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:e2e716fb-2a31-5d59-a1c3-018411322446",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-22060 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-test."
      }
    },
    {
      "id": "CVE-2021-22096",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-test@4.3.25.RELEASE-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:eaed0015-6343-5d81-9364-2c0339dd10c3",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2021-22096 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-test."
      }
    },
    {
      "id": "CVE-2024-22233",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-test@4.3.25.RELEASE-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:7fbf7ae3-491c-56d7-8776-732b1402b662",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-22233 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-test."
      }
    },
    {
      "id": "CVE-2025-41249",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-test@4.3.25.RELEASE-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:11d525ba-43b7-519f-bdde-d91b6cabe0bb",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-41249 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-test."
      }
    },
    {
      "id": "CVE-2026-22740",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-test@4.3.25.RELEASE-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:c4c277db-d37c-5b43-9cfd-65d67c2895bc",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-22740 does not affect version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-test. not_affected \u2014 Spring Framework 4.3.25.RELEASE is not affected by CVE-2026-22740. The vulnerability exists in WebFlux reactive multipart handling (introduced in Spring 5.0), which is absent from the 4.x series. Version 4.3.x uses servlet-based synchronous multipart processing with explicit cleanup mechanisms that prevent temp file leaks.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-41848",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-test@4.3.25.RELEASE-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:e4e70e16-91ed-5d6a-9a3f-ec7d838a02d0",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41848 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-test."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-test@4.3.25.RELEASE-tuxcare.6"
    }
  ]
}