{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:f214cb35-9ef8-5a65-a869-9e993f22c0f4",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-tx",
      "purl": "pkg:maven/org.springframework/spring-tx@6.0.23-tuxcare.11",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-tx@6.0.23-tuxcare.11",
      "version": "6.0.23-tuxcare.11",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-tx",
            "purl": "pkg:maven/org.springframework/spring-tx@6.0.23",
            "type": "library",
            "group": "org.springframework",
            "version": "6.0.23"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2009-1190",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-tx@6.0.23-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:06e41993-1387-5105-ab59-560e743d0670",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2009-1190 affects version 6.0.23-tuxcare.11 of org.springframework:spring-tx."
      }
    },
    {
      "id": "CVE-2011-2730",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-tx@6.0.23-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:09016544-7365-5711-a085-9fac034bc856",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2011-2730 affects version 6.0.23-tuxcare.11 of org.springframework:spring-tx."
      }
    },
    {
      "id": "CVE-2011-2894",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-tx@6.0.23-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:8dec34b2-3e07-5b60-8b65-3c5b6a83d60c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2011-2894 affects version 6.0.23-tuxcare.11 of org.springframework:spring-tx."
      }
    },
    {
      "id": "CVE-2014-3578",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-tx@6.0.23-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:642d0585-c66b-56bc-8e49-b29d917d4a85",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2014-3578 affects version 6.0.23-tuxcare.11 of org.springframework:spring-tx."
      }
    },
    {
      "id": "CVE-2015-0201",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-tx@6.0.23-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:9e7e07bd-ea3d-5fa3-8ad6-24b3818f935b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2015-0201 affects version 6.0.23-tuxcare.11 of org.springframework:spring-tx."
      }
    },
    {
      "id": "CVE-2015-5211",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-tx@6.0.23-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:f0732bfc-535d-5e9b-b2de-b7148f51f8e3",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2015-5211 affects version 6.0.23-tuxcare.11 of org.springframework:spring-tx."
      }
    },
    {
      "id": "CVE-2016-5007",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-tx@6.0.23-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:08a3d718-e523-5da8-96da-b4a92b027ab8",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2016-5007 affects version 6.0.23-tuxcare.11 of org.springframework:spring-tx."
      }
    },
    {
      "id": "CVE-2018-11040",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-tx@6.0.23-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:dd407b04-6831-5004-baab-3405399e09a2",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-11040 affects version 6.0.23-tuxcare.11 of org.springframework:spring-tx."
      }
    },
    {
      "id": "CVE-2018-1199",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-tx@6.0.23-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:eca8b2d6-7afd-5de5-a570-e4d3ff3963b6",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1199 affects version 6.0.23-tuxcare.11 of org.springframework:spring-tx."
      }
    },
    {
      "id": "CVE-2018-1257",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-tx@6.0.23-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:e959b545-9704-5bae-9a73-381e771ca534",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1257 does not affect version 6.0.23-tuxcare.11 of org.springframework:spring-tx. not_affected \u2014 CVE-2018-1257 affects Spring Framework versions with unconditional STOMP selector header parsing vulnerable to ReDoS. The target (6.0.23) contains the upstream fix from commit ff2228fdaf by rstoyanchev@pivotal.io that adds the ability to disable selector parsing via setSelectorHeaderName(null) and guards parsing with a null check. This fix was already present in the upstream Spring Framework 6....",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1258",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-tx@6.0.23-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:1ba46d94-de08-5a4f-9b0c-00eaef422734",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1258 affects version 6.0.23-tuxcare.11 of org.springframework:spring-tx."
      }
    },
    {
      "id": "CVE-2018-1271",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-tx@6.0.23-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:7a011aa5-93dd-5dac-9789-e5da06f4bd24",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1271 affects version 6.0.23-tuxcare.11 of org.springframework:spring-tx."
      }
    },
    {
      "id": "CVE-2018-1272",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-tx@6.0.23-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:94ecae7a-cf2f-5533-944b-936cdd1c09e8",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1272 affects version 6.0.23-tuxcare.11 of org.springframework:spring-tx."
      }
    },
    {
      "id": "CVE-2018-15756",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-tx@6.0.23-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:9caf7a7a-411b-5201-84a1-d95e468065a5",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-15756 affects version 6.0.23-tuxcare.11 of org.springframework:spring-tx."
      }
    },
    {
      "id": "CVE-2021-22060",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-tx@6.0.23-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:dccf98a6-a7c6-5f52-88de-87b0e345a4e8",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-22060 affects version 6.0.23-tuxcare.11 of org.springframework:spring-tx."
      }
    },
    {
      "id": "CVE-2021-22096",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-tx@6.0.23-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:d8471e17-463d-5a83-a7ea-adaf1178cb95",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-22096 affects version 6.0.23-tuxcare.11 of org.springframework:spring-tx."
      }
    },
    {
      "id": "CVE-2022-22965",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-tx@6.0.23-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:54a7ef3b-723a-54a6-9618-f1df66b7abff",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22965 does not affect version 6.0.23-tuxcare.11 of org.springframework:spring-tx. Spring Framework 6.0.23 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22970",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-tx@6.0.23-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:3c0baf86-451d-5847-982d-f644a0c99746",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22970 does not affect version 6.0.23-tuxcare.11 of org.springframework:spring-tx. not_affected \u2014 CVE-2022-22970 is NOT present in Spring Framework 6.0.23. The vulnerability allowed DoS through resource exhaustion when data binding MultipartFile/Part objects, caused by introspection of read-only properties with dangerous types (AutoCloseable, ClassLoader). The upstream fix was already included in the 6.0.23 release, introduced by Juergen Hoeller in commit 83186b689f11f5e6efe7ccc08fdeb92f66f...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-22233",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-tx@6.0.23-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:802928be-1fe5-54c7-86af-d980307d9ac2",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-22233 affects version 6.0.23-tuxcare.11 of org.springframework:spring-tx."
      }
    },
    {
      "id": "CVE-2025-41249",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-tx@6.0.23-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:04392882-1081-569d-bf83-00e61f1014ba",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-tx."
      }
    },
    {
      "id": "CVE-2026-41848",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-tx@6.0.23-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:8adef475-5af4-501f-944f-19b630c259a1",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-tx."
      }
    },
    {
      "id": "CVE-2026-59282",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-tx@6.0.23-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:3c653bfc-1810-50a0-a56e-cfe73618541e",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-tx."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-tx@6.0.23-tuxcare.11"
    }
  ]
}