{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:70d3ee49-f7eb-5289-97ef-797f2fdc9884",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-hateoas",
      "purl": "pkg:maven/org.springframework.hateoas/spring-hateoas@0.23.0.RELEASE-tuxcare.1",
      "type": "library",
      "group": "org.springframework.hateoas",
      "bom-ref": "pkg:maven/org.springframework.hateoas/spring-hateoas@0.23.0.RELEASE-tuxcare.1",
      "version": "0.23.0.RELEASE-tuxcare.1",
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2023-34036",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.hateoas/spring-hateoas@0.23.0.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:a5eb3462-ac0c-5c75-82d4-6590696dab00",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-34036 does not affect version 0.23.0.RELEASE-tuxcare.1 of org.springframework.hateoas:spring-hateoas. not_affected \u2014 Version 0.23.0.RELEASE (released 2016-12-22) predates Spring HATEOAS's WebFlux support by ~2.5 years. CVE-2023-34036 specifically affects the reactive/WebFlux component (WebFluxLinkBuilder.java), which does not exist in this version. The target uses Spring Framework 4.3.5 (predates Spring 5.0 which introduced WebFlux) and has no reactive dependencies. While the MVC component (ControllerLinkBuil...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-41006",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.hateoas/spring-hateoas@0.23.0.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:44da71ad-d8a8-5022-bec4-29265cceac86",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41006 does not affect version 0.23.0.RELEASE-tuxcare.1 of org.springframework.hateoas:spring-hateoas. Spring HATEOAS version 0.23.0.RELEASE is not affected by CVE-2026-41006. This version does not contain the vulnerable Collection+JSON or UBER media type deserializers. The HypermediaType enum only supports HAL, and the vulnerable PropertyUtils.createObjectFromProperties method that bypasses Jackson annotations does not exist in this codebase. The vulnerability affects later versions that introduced Collection+JSON and UBER support with custom reflection-based property binding.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-41007",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.hateoas/spring-hateoas@0.23.0.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:92048efb-475f-5728-8ff9-dc1f9343eee3",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41007 does not affect version 0.23.0.RELEASE-tuxcare.1 of org.springframework.hateoas:spring-hateoas. Version 0.23.0.RELEASE does not contain the StringLinkRelation class or its unbounded static cache. Link relations are stored as plain String fields in Link objects without any caching mechanism. The vulnerable architectural pattern was introduced in later versions (1.5.6+, 2.0.7+). Rule 5 Type A2 applies: the INPUT (link relation strings) is received, but no code path exists to reach the GOAL (unbounded static cache growth) because the static cache architecture doesn't exist in this version.",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.hateoas/spring-hateoas@0.23.0.RELEASE-tuxcare.1"
    }
  ]
}