{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:fa501b98-103a-5b2a-a8cc-145bd09b7026",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-integration-webflux",
      "purl": "pkg:maven/org.springframework.integration/spring-integration-webflux@6.5.9-tuxcare.2",
      "type": "library",
      "group": "org.springframework.integration",
      "bom-ref": "pkg:maven/org.springframework.integration/spring-integration-webflux@6.5.9-tuxcare.2",
      "version": "6.5.9-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-integration-webflux",
            "purl": "pkg:maven/org.springframework.integration/spring-integration-webflux@6.5.9",
            "type": "library",
            "group": "org.springframework.integration",
            "version": "6.5.9"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-40987",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.integration/spring-integration-webflux@6.5.9-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:379ab51b-0229-53d7-9c6c-77f46d15f962",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-40987 does not affect version 6.5.9-tuxcare.2 of org.springframework.integration:spring-integration-webflux. Spring Integration 6.5.9 contains the upstream fix for CVE-2026-40987 (path traversal in FTP/SFTP/SMB file downloads). The defense method FileUtils.newFileInDirectoryIfValid() validates all file paths before creation, rejecting absolute paths and directory traversal sequences. This fix was present in the upstream Spring Integration 6.5.9 release (authored by Glenn Renfro from Broadcom on June 1.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-47856",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.integration/spring-integration-webflux@6.5.9-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:d0827793-f44e-5d38-b40b-ff88117b38d5",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47856 is fixed in version 6.5.9-tuxcare.2 of org.springframework.integration:spring-integration-webflux."
      }
    },
    {
      "id": "CVE-2026-47859",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.integration/spring-integration-webflux@6.5.9-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:35acbe90-4e8f-5bee-ad72-0b15124f1b4d",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47859 is fixed in version 6.5.9-tuxcare.2 of org.springframework.integration:spring-integration-webflux."
      }
    },
    {
      "id": "CVE-2026-47861",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.integration/spring-integration-webflux@6.5.9-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:a8d0d51d-af8b-5d0e-a3b9-934b3e42a47e",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47861 is fixed in version 6.5.9-tuxcare.2 of org.springframework.integration:spring-integration-webflux."
      }
    },
    {
      "id": "CVE-2026-47862",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.integration/spring-integration-webflux@6.5.9-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:40aedf72-2014-5aa4-a277-20a2d92af78e",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47862 is fixed in version 6.5.9-tuxcare.2 of org.springframework.integration:spring-integration-webflux."
      }
    },
    {
      "id": "CVE-2026-47864",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.integration/spring-integration-webflux@6.5.9-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:f8ff6717-d28e-58f9-9bc4-73384a3f9baa",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47864 is fixed in version 6.5.9-tuxcare.2 of org.springframework.integration:spring-integration-webflux."
      }
    },
    {
      "id": "CVE-2026-47880",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.integration/spring-integration-webflux@6.5.9-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:7a49c676-de61-55b4-93da-72a627c8c269",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47880 is fixed in version 6.5.9-tuxcare.2 of org.springframework.integration:spring-integration-webflux."
      }
    },
    {
      "id": "CVE-2026-59274",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.integration/spring-integration-webflux@6.5.9-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:f737bfe3-9a8d-56c0-a8f7-abce49efc8e1",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59274 is fixed in version 6.5.9-tuxcare.2 of org.springframework.integration:spring-integration-webflux."
      }
    },
    {
      "id": "CVE-2026-59292",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.integration/spring-integration-webflux@6.5.9-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:7c13217d-1d5f-57fe-8205-e2210d1aa8f4",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59292 is fixed in version 6.5.9-tuxcare.2 of org.springframework.integration:spring-integration-webflux."
      }
    },
    {
      "id": "CVE-2026-59293",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.integration/spring-integration-webflux@6.5.9-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:b790dfa9-a702-5243-a1e1-c9175a5e02a2",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59293 is fixed in version 6.5.9-tuxcare.2 of org.springframework.integration:spring-integration-webflux."
      }
    },
    {
      "id": "CVE-2026-59307",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.integration/spring-integration-webflux@6.5.9-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:7502b331-9d36-53da-bc52-5ab9fd4d8895",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59307 is fixed in version 6.5.9-tuxcare.2 of org.springframework.integration:spring-integration-webflux."
      }
    },
    {
      "id": "CVE-2026-59311",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.integration/spring-integration-webflux@6.5.9-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:31540cfe-2f39-52e5-9eaa-b59ec52c698a",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59311 is fixed in version 6.5.9-tuxcare.2 of org.springframework.integration:spring-integration-webflux."
      }
    },
    {
      "id": "CVE-2026-59321",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.integration/spring-integration-webflux@6.5.9-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:71464a1f-566d-5d95-9860-664403172f9a",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59321 is fixed in version 6.5.9-tuxcare.2 of org.springframework.integration:spring-integration-webflux."
      }
    },
    {
      "id": "CVE-2026-59322",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.integration/spring-integration-webflux@6.5.9-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:8a2f2eae-1e37-5f16-a422-f11b59afe25d",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59322 is fixed in version 6.5.9-tuxcare.2 of org.springframework.integration:spring-integration-webflux."
      }
    },
    {
      "id": "CVE-2026-59324",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.integration/spring-integration-webflux@6.5.9-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:e8c72b5f-bbf0-5467-8c2d-8306880101d5",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59324 is fixed in version 6.5.9-tuxcare.2 of org.springframework.integration:spring-integration-webflux."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.integration/spring-integration-webflux@6.5.9-tuxcare.2"
    }
  ]
}