{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:57182631-4db8-5da6-8091-5aba280646df",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-tx",
      "purl": "pkg:maven/org.springframework/spring-tx@4.3.20.RELEASE-tuxcare.2",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-tx@4.3.20.RELEASE-tuxcare.2",
      "version": "4.3.20.RELEASE-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-tx",
            "purl": "pkg:maven/org.springframework/spring-tx@4.3.20.RELEASE",
            "type": "library",
            "group": "org.springframework",
            "version": "4.3.20.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2009-1190",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-tx@4.3.20.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:c6b26ff7-eeee-5f2e-b4e3-c8ef487f09cb",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2009-1190 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-tx."
      }
    },
    {
      "id": "CVE-2011-2730",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-tx@4.3.20.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:1ef27b9a-9510-5ddf-b6e5-e718489398a3",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2011-2730 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-tx."
      }
    },
    {
      "id": "CVE-2011-2894",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-tx@4.3.20.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:032bd58a-89e9-57ac-a544-7bd785c62a70",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2011-2894 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-tx."
      }
    },
    {
      "id": "CVE-2014-3578",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-tx@4.3.20.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:5086637a-ca20-5548-948c-593165bec124",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2014-3578 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-tx."
      }
    },
    {
      "id": "CVE-2015-0201",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-tx@4.3.20.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:2e975b1a-fd58-5ab8-8cab-d037966a0a2a",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2015-0201 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-tx."
      }
    },
    {
      "id": "CVE-2015-5211",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-tx@4.3.20.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:5e29bdfd-35a4-52f6-81fa-09c5bc2fcd99",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2015-5211 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-tx."
      }
    },
    {
      "id": "CVE-2016-5007",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-tx@4.3.20.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:fa6029ca-9446-5b22-9f79-fbe66d3fa190",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2016-5007 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-tx."
      }
    },
    {
      "id": "CVE-2018-11040",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-tx@4.3.20.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:25e97fc0-705b-5b4f-858d-3406c2b65299",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-11040 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-tx."
      }
    },
    {
      "id": "CVE-2018-1199",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-tx@4.3.20.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:f7993720-f461-5160-ad91-264c403da468",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1199 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-tx."
      }
    },
    {
      "id": "CVE-2018-1257",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-tx@4.3.20.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:e61177ef-75f3-5374-be20-79419cfb5af4",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1257 does not affect version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-tx. not_affected \u2014 Target version 4.3.20.RELEASE is not affected by CVE-2018-1257. The vulnerability (regex DoS via malicious SpEL expressions in STOMP selector headers) was fixed by upstream Spring Framework in version 4.3.17 through two defensive measures: (1) switching from StandardEvaluationContext to SimpleEvaluationContext to restrict expression capabilities, and (2) adding configuration support to disable ...",
        "justification": "protected_at_runtime"
      }
    },
    {
      "id": "CVE-2018-1258",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-tx@4.3.20.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:dd2f4769-682c-51ea-bb12-dccf8801bdfb",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1258 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-tx."
      }
    },
    {
      "id": "CVE-2018-1271",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-tx@4.3.20.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:2fd6a94a-dea5-5845-929a-d573136677e5",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1271 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-tx."
      }
    },
    {
      "id": "CVE-2018-1272",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-tx@4.3.20.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:e245e39a-7b87-5d83-a529-6fb06b9afb24",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1272 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-tx."
      }
    },
    {
      "id": "CVE-2018-15756",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-tx@4.3.20.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:7ccf6eab-cf8d-55cd-8d9f-e73133bdd000",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-15756 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-tx."
      }
    },
    {
      "id": "CVE-2021-22060",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-tx@4.3.20.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:a27bb011-44a8-5f93-a7de-4cbb342e4a6d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-22060 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-tx."
      }
    },
    {
      "id": "CVE-2021-22096",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-tx@4.3.20.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:539648a6-3d4b-59b2-abe3-f825750930ec",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2021-22096 is fixed in version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-tx."
      }
    },
    {
      "id": "CVE-2022-22965",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-tx@4.3.20.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:46a7ae5c-74a7-50d0-b7c4-b4cf83c7597b",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-tx."
      }
    },
    {
      "id": "CVE-2022-22970",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-tx@4.3.20.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:6c0a12df-51d4-54f1-9b7e-d37f1cea09e0",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-22970 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-tx."
      }
    },
    {
      "id": "CVE-2024-22233",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-tx@4.3.20.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:978f41aa-8f8b-5608-bec2-b28215c2976d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-22233 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-tx."
      }
    },
    {
      "id": "CVE-2025-41249",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-tx@4.3.20.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:05c36cd5-9837-5aa4-9f91-163742d56228",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-41249 is fixed in version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-tx."
      }
    },
    {
      "id": "CVE-2026-41848",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-tx@4.3.20.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:4be52f1e-9cf5-5a4f-8f0c-ab9ee39458f1",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41848 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-tx."
      }
    },
    {
      "id": "CVE-2026-59282",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-tx@4.3.20.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:b1c74621-b2b3-512e-b463-ec5b796f853b",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59282 is fixed in version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-tx."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-tx@4.3.20.RELEASE-tuxcare.2"
    }
  ]
}