{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:b82cb9a2-5383-5c20-b49a-f241d829716e",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-test",
      "purl": "pkg:maven/org.springframework/spring-test@6.1.14-tuxcare.2",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-test@6.1.14-tuxcare.2",
      "version": "6.1.14-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-test",
            "purl": "pkg:maven/org.springframework/spring-test@6.1.14",
            "type": "library",
            "group": "org.springframework",
            "version": "6.1.14"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2009-1190",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-test@6.1.14-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:25aeb1ad-197f-5cd6-982c-ee8311da2b08",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2009-1190 does not affect version 6.1.14-tuxcare.2 of org.springframework:spring-test. not_affected \u2014 Spring Framework 6.1.14 is not affected by CVE-2009-1190. This CVE describes an algorithmic complexity vulnerability in java.util.regex.Pattern.compile in JDK versions before 1.6. Spring Framework 6.1.14 requires Java 17+ (documented in framework-docs/modules/ROOT/pages/overview.adoc), which has long since fixed the underlying JDK bug. The vulnerable runtime environment (JDK < 1.6) is not and c...",
        "justification": "requires_environment"
      }
    },
    {
      "id": "CVE-2011-2730",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-test@6.1.14-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:3273b269-f566-52a1-8769-3ac7e8315106",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2011-2730 affects version 6.1.14-tuxcare.2 of org.springframework:spring-test."
      }
    },
    {
      "id": "CVE-2011-2894",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-test@6.1.14-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:5c85ca1c-672c-5854-a27c-b31b28f21245",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2011-2894 affects version 6.1.14-tuxcare.2 of org.springframework:spring-test."
      }
    },
    {
      "id": "CVE-2014-3578",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-test@6.1.14-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:b60935ae-e708-5178-a10d-45725c0b49d7",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2014-3578 affects version 6.1.14-tuxcare.2 of org.springframework:spring-test."
      }
    },
    {
      "id": "CVE-2015-0201",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-test@6.1.14-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:af6d1bac-9aa2-5afb-bc09-8a9505bb2b38",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2015-0201 affects version 6.1.14-tuxcare.2 of org.springframework:spring-test."
      }
    },
    {
      "id": "CVE-2015-5211",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-test@6.1.14-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:fcd77585-9f38-5980-9cbe-bad1e97d90bc",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2015-5211 affects version 6.1.14-tuxcare.2 of org.springframework:spring-test."
      }
    },
    {
      "id": "CVE-2016-5007",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-test@6.1.14-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:08b06a60-6a04-5e16-9d7b-50d68772653d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2016-5007 affects version 6.1.14-tuxcare.2 of org.springframework:spring-test."
      }
    },
    {
      "id": "CVE-2018-11040",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-test@6.1.14-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:dfe0fe0d-a964-518f-b04d-0eca5aff8a06",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-11040 affects version 6.1.14-tuxcare.2 of org.springframework:spring-test."
      }
    },
    {
      "id": "CVE-2018-1199",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-test@6.1.14-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:25feb19f-84c8-5c2f-bdac-dfab1c64d1b7",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1199 affects version 6.1.14-tuxcare.2 of org.springframework:spring-test."
      }
    },
    {
      "id": "CVE-2018-1257",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-test@6.1.14-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:66ea30da-4ec4-5b8b-909c-2091450a6738",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1257 does not affect version 6.1.14-tuxcare.2 of org.springframework:spring-test. not_affected \u2014 Target Spring Framework 6.1.14 is NOT affected by CVE-2018-1257. The vulnerability pattern (enabled-by-default selector header processing accepting untrusted SpEL expressions) is not present. An upstream fix (commit 5bc80fc094 by sam@sambrannen.com, June 2023) disabled the SpEL selector feature by default in Spring Framework 6.1+. This fix was already included in the upstream 6.1.14 release tha...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1258",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-test@6.1.14-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:180320de-4b65-5295-a68f-df5055bb919c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1258 affects version 6.1.14-tuxcare.2 of org.springframework:spring-test."
      }
    },
    {
      "id": "CVE-2018-1271",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-test@6.1.14-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:a513f2aa-b667-5a80-bf6d-07dcd93efb60",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1271 affects version 6.1.14-tuxcare.2 of org.springframework:spring-test."
      }
    },
    {
      "id": "CVE-2018-1272",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-test@6.1.14-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:a0364c91-0640-59c6-8668-4edb7c98bc7e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1272 affects version 6.1.14-tuxcare.2 of org.springframework:spring-test."
      }
    },
    {
      "id": "CVE-2018-15756",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-test@6.1.14-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:466fa361-8b0e-5507-bc9d-3870927fdc33",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-15756 affects version 6.1.14-tuxcare.2 of org.springframework:spring-test."
      }
    },
    {
      "id": "CVE-2021-22060",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-test@6.1.14-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:2e65989b-8401-5f94-98f2-2cc5010b69e6",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-22060 affects version 6.1.14-tuxcare.2 of org.springframework:spring-test."
      }
    },
    {
      "id": "CVE-2021-22096",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-test@6.1.14-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:72993e34-b643-561d-9d5e-34113d29bc67",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-22096 affects version 6.1.14-tuxcare.2 of org.springframework:spring-test."
      }
    },
    {
      "id": "CVE-2024-22233",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-test@6.1.14-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:fd1ac6c6-a874-5f5e-97ba-0821d8568ead",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-22233 affects version 6.1.14-tuxcare.2 of org.springframework:spring-test."
      }
    },
    {
      "id": "CVE-2025-41249",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-test@6.1.14-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:460a95e6-9743-5b4f-8562-a4e6e1ad1265",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.1.14-tuxcare.2 of org.springframework:spring-test."
      }
    },
    {
      "id": "CVE-2026-41848",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-test@6.1.14-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:2fa878d9-7160-55b2-b31b-9008d374245d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41848 affects version 6.1.14-tuxcare.2 of org.springframework:spring-test, and is fixed in 6.1.14-tuxcare.3."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-test@6.1.14-tuxcare.2"
    }
  ]
}