{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:88628c32-2cba-595e-84a7-3b43a627b2ce",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-webmvc",
      "purl": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1",
      "version": "6.2.3-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-webmvc",
            "purl": "pkg:maven/org.springframework/spring-webmvc@6.2.3",
            "type": "library",
            "group": "org.springframework",
            "version": "6.2.3"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2009-1190",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:5539db41-81cc-5254-8848-15bad4f7fc93",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2009-1190 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2011-2730",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:9e9417dc-dc0e-59ca-b0fc-e07f64c9fdfd",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2011-2730 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2011-2894",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:3ce9f106-a105-51d1-ad97-bc449790f6d1",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2011-2894 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2013-6429",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:9ed1ce29-1f59-5b8b-a410-72c365ddd754",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2013-6429 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2013-6430",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:fe3eec80-f39e-5dfd-bbd8-e564ac2dabf7",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2013-6430 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2014-0054",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:be0e889f-c120-5f4d-859d-f44870cf78c7",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2014-0054 does not affect version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-0054 (XXE vulnerability in Jaxb2RootElementHttpMessageConverter) is NOT present in Spring Framework 6.2.3. The XXE protection was introduced in the upstream Spring Framework release 3.2.8/4.0.2 in February 2014 (commit edba32b309) by Rossen Stoyanchev, long before TuxCare onboarded version 6.2.3. The current code at spring-web/src/main/java/org/springframework/http/converter/xml/Jaxb2R...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2014-0225",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:66abb564-49d1-549a-ad46-cae7e063fddb",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2014-0225 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2014-1904",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:81c6319e-c2c2-54f2-84d7-ad3eb3d31767",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2014-1904 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2014-3578",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:997542a2-0fb3-51c3-b4f0-cf9c2ff40389",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2014-3578 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2014-3625",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:165d2dbc-fbd4-529e-823a-0a5ca23ea0d9",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2014-3625 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2015-0201",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:c96f8480-f891-5a5f-a23f-e14d0a6ae3bb",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2015-0201 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2015-3192",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:e3e94554-aedb-5252-8be6-d0a671b7b8e1",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2015-3192 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2015-5211",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:363b3563-3ff5-569c-947c-6b95e7608888",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2015-5211 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2016-1000027",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:ccb44112-7b37-5425-b315-a54e50b5358b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2016-1000027 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2016-5007",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:22a380f7-9a2e-52ca-ab6d-9e3b1a0732ce",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2016-5007 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2016-9878",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:eb9ae8d7-4081-5828-b2b8-25d4da6f99d2",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2016-9878 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2018-11039",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:ee212ea4-ffac-58d8-8fe9-7c199fc48b23",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-11039 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2018-11040",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:cedd9229-cc66-5948-937c-c2b0a74457d4",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-11040 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2018-1199",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:83f2c726-4e9b-5059-afd5-69bcae2b41eb",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1199 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2018-1257",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:f9ceee0a-32ea-5c9d-8465-32005e9ee82c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1257 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2018-1258",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:2cbc6c93-c64e-570c-88ed-6acae1030ed4",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1258 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2018-1271",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:931a6389-7efa-5374-a8c5-2bda95327c0d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1271 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2018-1272",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:195d817e-1c70-5153-87f0-04ae30534c71",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1272 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2018-15756",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:d0a00272-85b3-5880-82c2-4f301a6e15df",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-15756 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2020-5397",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:4cdb378d-d276-54d5-a7a7-77ac75e541df",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2020-5397 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2020-5398",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:a813d69f-f513-5619-8b89-e0d6b3a24ec6",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2020-5398 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2021-22060",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:e9320652-720c-5422-99bc-ee4350a5d619",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-22060 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2021-22096",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:77dff45b-5290-5573-a02c-1110eabce838",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-22096 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2021-22118",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:a3330714-ed39-5d9c-8862-132d3e61a741",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-22118 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2022-22950",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:b1295b0f-729a-5441-a0d7-7f573392c6d2",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-22950 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2022-22965",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:4f2471ee-e865-59d6-96c5-788965d564a1",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-22965 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2022-22968",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:7a2fd5e6-4048-55a9-931e-21d45ea411d9",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-22968 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2022-22970",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:fb63d346-a2b9-58bd-b06a-dd9cc803b9db",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-22970 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2023-20860",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:b30611e9-10a9-58b7-b971-0b2bd5ccbac6",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-20860 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2023-20861",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:e307e93e-5a81-59dc-a177-b5e4b1711ad4",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-20861 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2023-20863",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:31434972-3add-5a74-a597-3cf701f863c8",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-20863 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2023-34053",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:bed30ddb-be2e-5952-9f68-b52588957397",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-34053 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2024-22233",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:23968d90-0b9f-5efb-b44e-1b2a6cedb8a3",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-22233 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2024-22243",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:c9c7cff5-1add-5c93-8d80-d526cf89ebf4",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-22243 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2024-22259",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:fd88a3df-c99d-5006-888b-563b34c3dc9f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-22259 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2024-22262",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:4a2b1a9d-3a0b-5076-87fc-cba968164bc9",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-22262 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2024-38808",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:213f024d-ed03-51df-ab28-a099ac56191e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-38808 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2024-38809",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:a08b2560-7686-5344-bdcc-bf1186432ea4",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-38809 does not affect version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2024-38809 is NOT present in Spring Framework 6.2.3. The vulnerability (regex-based ETag parsing causing DoS via catastrophic backtracking) was fixed in the upstream release before TuxCare onboarded version 6.2.3. The fix commit bb17ad8314b81850a939fd265fb53b3361705e85 by rossen.stoyanchev@broadcom.com replaced the vulnerable regex pattern with an efficient O(n) state-machine parser. The ta...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-38816",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:9738a733-f86d-51bf-b5ab-a980a79836b8",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-38816 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2024-38819",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:b201cc36-b4f8-587d-b14a-0ed2b59284d0",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-38819 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2024-38820",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:aa22413e-74bd-5785-9844-a48bdd1897d1",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-38820 does not affect version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc. not_affected \u2014 The target Spring Framework 6.2.3 is NOT affected by CVE-2024-38820. The vulnerability involves locale-dependent String.toLowerCase() in DataBinder's disallowedFields protection, which could allow attackers to bypass field access restrictions using locale-sensitive characters (e.g., Turkish 'I' \u2192 '\u0131'). The fix (using Locale.ROOT for consistent case conversion) was authored by the upstream Sprin...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-38828",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:bba9fd14-1bf8-5570-92bd-397d3cd4455a",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-38828 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2025-22233",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:a7538a0a-2645-5ad4-b2e2-2271b423f552",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-22233 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2025-41234",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:0230ac21-7f4f-509a-b7b9-ba2ebeaaff8b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-41234 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2025-41242",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:a1b8ca35-baf6-5d80-842e-e6eec4c2859c",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2025-41249",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:348d6e6d-a1ee-51ce-9179-59cccb5b66c2",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2026-22735",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:bd7ca310-b892-5bca-ade8-6249958381b1",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2026-22737",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:2fa7a02f-1aa6-5428-a012-926af06491fd",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2026-22741",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:29cc800e-38f2-5f06-b68d-05b3933d99bb",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2026-22745",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:0993b926-b545-5454-ab72-d64deb1bad3b",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2026-41841",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:6e08bdbe-6400-5b1a-b773-aa87117128ba",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2026-41842",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:b2338ef2-39b1-52a0-9f87-334b62c94167",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41842 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2026-41843",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:8539bc03-c8f3-5a42-9541-8ee6b013aead",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41843 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2026-41844",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:45977d63-696e-5e00-9b59-cfc2b397d8df",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2026-41845",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:6aa16901-84e6-55a3-9ec0-2f086c6c8652",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2026-41846",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:42b6b9a3-7121-5e3d-82f3-6ea2737c3456",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2026-41848",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:098988f8-d0c1-5cad-aa1f-1d8b6a29b9aa",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41848 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2026-41849",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:2e857e51-21eb-5f84-8cc1-d8d4bc4ef98b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41849 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2026-41850",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:f3374dfe-406f-516d-bbea-9d77155f8821",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2026-41851",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:fc04cf06-1f3f-5210-ac00-088a1bd6b879",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41851 affects version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc, and is fixed in 6.2.3-tuxcare.3."
      }
    },
    {
      "id": "CVE-2026-41852",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:91755467-d059-57ab-9501-5645a677483d",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2026-41853",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:c8ec7179-73cd-54f2-b1af-0a1c402aea2b",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2026-41854",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:88751fad-c139-54a0-92ac-1982f416b6ab",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2026-47883",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:5dd3aa00-be77-5d58-b2d5-e9856e7e395b",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47883 is fixed in version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2026-47884",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:8704a2fb-e655-5add-93fe-7a3e14b4d539",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2026-47885",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:ab38816d-5f37-5c48-b1cd-1098a548aeb3",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47885 is fixed in version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2026-47886",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:102fb605-ecbf-52b2-a655-71d0295c220f",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2026-47887",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:ce3cec46-2d40-5614-9588-e91aa81e038c",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2026-47889",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:dea0c879-b6fb-5fff-a739-de41c75539f1",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47889 is fixed in version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2026-47890",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:d242f190-c7b4-5966-a0d8-a48b574be287",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47890 is fixed in version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2026-59281",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:98931fd4-9449-5cf1-a953-e33fd789b2f8",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2026-59282",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:05d74d08-31ee-5915-9500-05c2ee8185ec",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2026-59283",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:ed11c45b-fe1f-51b2-97f3-2570d1c8f1c6",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2026-59313",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:11650ea2-6294-5e9f-bad6-7458410ed850",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2026-59314",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:9e2290cb-d9de-53a6-96a8-356287996964",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.2.3-tuxcare.1 of org.springframework:spring-webmvc."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.1"
    }
  ]
}