{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:26cd3773-0037-514f-a635-8f7f96529894",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-tx",
      "purl": "pkg:maven/org.springframework/spring-tx@5.3.32-tuxcare.1",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-tx@5.3.32-tuxcare.1",
      "version": "5.3.32-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-tx",
            "purl": "pkg:maven/org.springframework/spring-tx@5.3.32",
            "type": "library",
            "group": "org.springframework",
            "version": "5.3.32"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2009-1190",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-tx@5.3.32-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:9e74015e-d3a3-550a-960a-cc1b82c569ec",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2009-1190 affects version 5.3.32-tuxcare.1 of org.springframework:spring-tx."
      }
    },
    {
      "id": "CVE-2011-2730",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-tx@5.3.32-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:b27eac43-aebc-5bed-bc37-9d21cc6a2317",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2011-2730 affects version 5.3.32-tuxcare.1 of org.springframework:spring-tx."
      }
    },
    {
      "id": "CVE-2011-2894",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-tx@5.3.32-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:bbf9442e-0db3-5122-8103-f57e17d07747",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2011-2894 affects version 5.3.32-tuxcare.1 of org.springframework:spring-tx."
      }
    },
    {
      "id": "CVE-2014-3578",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-tx@5.3.32-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:dd06bc9a-8c8e-50cf-9e31-9010753587ab",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2014-3578 affects version 5.3.32-tuxcare.1 of org.springframework:spring-tx."
      }
    },
    {
      "id": "CVE-2015-0201",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-tx@5.3.32-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:2996e1e6-f07d-59c4-b0ae-90a7029faaf8",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2015-0201 affects version 5.3.32-tuxcare.1 of org.springframework:spring-tx."
      }
    },
    {
      "id": "CVE-2015-5211",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-tx@5.3.32-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:170cf443-9f6d-5db9-8abe-8161d9756b31",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2015-5211 affects version 5.3.32-tuxcare.1 of org.springframework:spring-tx."
      }
    },
    {
      "id": "CVE-2016-5007",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-tx@5.3.32-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:a5fa54bd-d528-54e5-a81e-5ff62b3eff4e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2016-5007 affects version 5.3.32-tuxcare.1 of org.springframework:spring-tx."
      }
    },
    {
      "id": "CVE-2018-11040",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-tx@5.3.32-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:36921802-f13f-5c38-9c81-82692b48b031",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-11040 affects version 5.3.32-tuxcare.1 of org.springframework:spring-tx."
      }
    },
    {
      "id": "CVE-2018-1199",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-tx@5.3.32-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:0b313b8f-329e-5245-963c-984ca2ac69d9",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1199 affects version 5.3.32-tuxcare.1 of org.springframework:spring-tx."
      }
    },
    {
      "id": "CVE-2018-1257",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-tx@5.3.32-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:0e9b6d36-b880-5514-b025-c9b6eaa6fc59",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1257 does not affect version 5.3.32-tuxcare.1 of org.springframework:spring-tx. not_affected \u2014 The target Spring Framework 5.3.32 is NOT affected by CVE-2018-1257 (STOMP selector ReDoS vulnerability). The upstream vendor fix was already present in the 5.3.32 release that TuxCare onboarded. The fix adds a null-check guard around selector expression parsing in DefaultSubscriptionRegistry.getSelectorExpression() (lines 162-164), allowing the selector feature to be disabled entirely by setti...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1258",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-tx@5.3.32-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:0347ae1f-e64f-5a84-bfce-3f4302ab480e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1258 affects version 5.3.32-tuxcare.1 of org.springframework:spring-tx."
      }
    },
    {
      "id": "CVE-2018-1271",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-tx@5.3.32-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:5cf057cf-1c17-51ea-a28b-380e70025b72",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1271 affects version 5.3.32-tuxcare.1 of org.springframework:spring-tx."
      }
    },
    {
      "id": "CVE-2018-1272",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-tx@5.3.32-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:6fe3c072-b133-5790-911e-aa1103086026",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1272 affects version 5.3.32-tuxcare.1 of org.springframework:spring-tx."
      }
    },
    {
      "id": "CVE-2018-15756",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-tx@5.3.32-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:a7940b19-8da3-5456-9d58-1ae68e016797",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-15756 affects version 5.3.32-tuxcare.1 of org.springframework:spring-tx."
      }
    },
    {
      "id": "CVE-2021-22060",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-tx@5.3.32-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:ff8a7fa2-ea77-52fc-ad6f-1f7a04d8cc56",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-22060 affects version 5.3.32-tuxcare.1 of org.springframework:spring-tx."
      }
    },
    {
      "id": "CVE-2021-22096",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-tx@5.3.32-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:2d60041a-0320-529d-80ca-409d477e9e07",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-22096 affects version 5.3.32-tuxcare.1 of org.springframework:spring-tx."
      }
    },
    {
      "id": "CVE-2022-22965",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-tx@5.3.32-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:153ed3eb-8271-5b9d-90de-74261fcb8d7e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22965 does not affect version 5.3.32-tuxcare.1 of org.springframework:spring-tx. Spring Framework 5.3.32 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22970",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-tx@5.3.32-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:86054a94-8d4d-5768-8a35-ed7b413b091d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22970 does not affect version 5.3.32-tuxcare.1 of org.springframework:spring-tx. not_affected \u2014 CVE-2022-22970 fix was already present in the upstream Spring Framework 5.3.32 release. The vulnerability affects applications handling file uploads with data binding to MultipartFile/Part fields, allowing DoS through repeated access to expensive read-only property getters. The fix (commit 83186b689f, May 2022) filters AutoCloseable, ClassLoader, and ProtectionDomain read-only properties during...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-22233",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-tx@5.3.32-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:22248934-58a2-5879-8aed-91a047d6a9c2",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-22233 affects version 5.3.32-tuxcare.1 of org.springframework:spring-tx."
      }
    },
    {
      "id": "CVE-2025-41249",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-tx@5.3.32-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:b8ba9574-a583-5aea-8277-4529e0297799",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-41249 affects version 5.3.32-tuxcare.1 of org.springframework:spring-tx."
      }
    },
    {
      "id": "CVE-2026-41848",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-tx@5.3.32-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:b28a1c60-8e8b-5bf6-84be-58a408439834",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41848 affects version 5.3.32-tuxcare.1 of org.springframework:spring-tx, and is fixed in 5.3.32-tuxcare.2."
      }
    },
    {
      "id": "CVE-2026-59282",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-tx@5.3.32-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:e3683f6a-f583-5d5c-8966-f0ba2895c78f",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.32-tuxcare.1 of org.springframework:spring-tx."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-tx@5.3.32-tuxcare.1"
    }
  ]
}