{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:92fadca5-0de2-5469-90f7-5f6835abfb48",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.6",
      "type": "library",
      "group": "org.springframework",
      "name": "spring-webmvc",
      "version": "5.3.37-tuxcare.6",
      "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.6"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:732c6b9d-ead1-54eb-9a8b-4987bae7677d",
      "id": "CVE-2016-1000027",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.37-tuxcare.6 of org.springframework:spring-webmvc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:9fbea4ae-39fd-529b-ac01-1421db33d473",
      "id": "CVE-2024-38808",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.37-tuxcare.6 of org.springframework:spring-webmvc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:316d822a-f741-5dbd-b173-208c145ba61f",
      "id": "CVE-2024-38809",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.37-tuxcare.6 of org.springframework:spring-webmvc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:ab5fa096-41f5-5970-aded-c547dd754e58",
      "id": "CVE-2024-38816",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.37-tuxcare.6 of org.springframework:spring-webmvc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:c07113ca-8ccd-58af-a0cd-4ec0bb34dc4a",
      "id": "CVE-2024-38819",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.37-tuxcare.6 of org.springframework:spring-webmvc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:fecf01f8-5ae7-5d9e-b7ce-ea231ee5663d",
      "id": "CVE-2024-38820",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.37-tuxcare.6 of org.springframework:spring-webmvc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:3fd8311b-2ae6-5d9e-ae51-85be085c3b9d",
      "id": "CVE-2024-38828",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-38828 affects version 5.3.37-tuxcare.6 of org.springframework:spring-webmvc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:072ad613-93fa-550e-81bc-a8b770e54e08",
      "id": "CVE-2025-22233",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.37-tuxcare.6 of org.springframework:spring-webmvc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:8163e52b-6634-51cd-be80-b526f125c84e",
      "id": "CVE-2025-41242",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-41242 affects version 5.3.37-tuxcare.6 of org.springframework:spring-webmvc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:1facbacc-de12-5288-8072-037cf97ad458",
      "id": "CVE-2025-41249",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.37-tuxcare.6 of org.springframework:spring-webmvc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:bfb08182-3523-5ae7-970c-14c02778b3c4",
      "id": "CVE-2025-41254",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-41254 affects version 5.3.37-tuxcare.6 of org.springframework:spring-webmvc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:3fa0d999-1827-5efa-9247-8b8577cc2cd2",
      "id": "CVE-2026-22735",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.37-tuxcare.6 of org.springframework:spring-webmvc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:3eb57df5-78dc-5dad-bc04-8c9835509223",
      "id": "CVE-2026-22737",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.37-tuxcare.6 of org.springframework:spring-webmvc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:9e908b6e-0a6b-50dd-b168-3ca2c6548326",
      "id": "CVE-2026-22740",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.37-tuxcare.6 of org.springframework:spring-webmvc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d9936e22-9862-58d2-b8ad-6b0f80ab45d2",
      "id": "CVE-2026-22741",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-22741 affects version 5.3.37-tuxcare.6 of org.springframework:spring-webmvc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:bc33f79f-e2c2-57c8-a1ff-897e6ff6972f",
      "id": "CVE-2026-22745",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.37-tuxcare.6 of org.springframework:spring-webmvc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:1624c2ff-f049-5eb9-bccd-1fa71b005502",
      "id": "CVE-2026-41838",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41838 affects version 5.3.37-tuxcare.6 of org.springframework:spring-webmvc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:aba3322c-56b5-526b-b883-6a8968b5e189",
      "id": "CVE-2026-41839",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41839 affects version 5.3.37-tuxcare.6 of org.springframework:spring-webmvc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:064b1205-acd3-55c0-b70f-c57e19a59bbe",
      "id": "CVE-2026-41840",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.37-tuxcare.6 of org.springframework:spring-webmvc. already_fixed \u2014 The target repository (Spring Framework 5.3.37-tuxcare.6) already contains both fixes for CVE-2026-41840. The fixes were backported on June 8, 2026 via commit 648b33d0a3 as part of CVE-2026-22740 remediation, which addresses the same multipart memory leak vulnerability."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:5aa76ab4-3f7c-5733-80c7-3fe86ff72319",
      "id": "CVE-2026-41841",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41841 affects version 5.3.37-tuxcare.6 of org.springframework:spring-webmvc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:752e91ab-641c-570a-b27f-96a4fe0a978e",
      "id": "CVE-2026-41842",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41842 affects version 5.3.37-tuxcare.6 of org.springframework:spring-webmvc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d420c377-1535-5c27-a35c-f9cae4bb4021",
      "id": "CVE-2026-41843",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41843 affects version 5.3.37-tuxcare.6 of org.springframework:spring-webmvc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:2261d633-23db-52d7-a4f1-f216fca8ff5f",
      "id": "CVE-2026-41844",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41844 affects version 5.3.37-tuxcare.6 of org.springframework:spring-webmvc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:db1d19c6-f95f-5471-823d-e33429d394bb",
      "id": "CVE-2026-41845",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41845 affects version 5.3.37-tuxcare.6 of org.springframework:spring-webmvc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:62a5b0da-eda9-50ee-8b2a-6b8e120a5859",
      "id": "CVE-2026-41846",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41846 affects version 5.3.37-tuxcare.6 of org.springframework:spring-webmvc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:14f80655-77ad-555a-b2a9-0dea0033a9ec",
      "id": "CVE-2026-41847",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41847 affects version 5.3.37-tuxcare.6 of org.springframework:spring-webmvc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:38764017-068f-5c70-9750-b91b4fdfd166",
      "id": "CVE-2026-41848",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41848 affects version 5.3.37-tuxcare.6 of org.springframework:spring-webmvc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:36bed13d-e8af-5974-b398-221b65f3ab0f",
      "id": "CVE-2026-41849",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41849 affects version 5.3.37-tuxcare.6 of org.springframework:spring-webmvc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:65fb4a8b-cb49-5c70-970d-a6dafd2c0190",
      "id": "CVE-2026-41850",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41850 affects version 5.3.37-tuxcare.6 of org.springframework:spring-webmvc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:51d93646-ff5f-57bd-8388-611de2e81d33",
      "id": "CVE-2026-41851",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41851 affects version 5.3.37-tuxcare.6 of org.springframework:spring-webmvc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:6851104a-42a4-503d-bde4-a9b92a302fb3",
      "id": "CVE-2026-41852",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41852 affects version 5.3.37-tuxcare.6 of org.springframework:spring-webmvc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:679b8f2b-0dbc-5bd3-baa3-9169c5998368",
      "id": "CVE-2026-41853",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41853 affects version 5.3.37-tuxcare.6 of org.springframework:spring-webmvc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:3504c50a-403c-5ea3-a506-547b41ef3d8f",
      "id": "CVE-2026-41855",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41855 affects version 5.3.37-tuxcare.6 of org.springframework:spring-webmvc."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.6"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.37-tuxcare.6"
    }
  ]
}