{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:a082fb5d-fca3-5f73-8af4-fbfa6a707946",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-integration-xmpp",
      "purl": "pkg:maven/org.springframework.integration/spring-integration-xmpp@6.5.10-tuxcare.3",
      "type": "library",
      "group": "org.springframework.integration",
      "bom-ref": "pkg:maven/org.springframework.integration/spring-integration-xmpp@6.5.10-tuxcare.3",
      "version": "6.5.10-tuxcare.3",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-integration-xmpp",
            "purl": "pkg:maven/org.springframework.integration/spring-integration-xmpp@6.5.10",
            "type": "library",
            "group": "org.springframework.integration",
            "version": "6.5.10"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-40987",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.integration/spring-integration-xmpp@6.5.10-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:1546e8e1-5a98-56d2-8e84-5be6d3df13f9",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-40987 does not affect version 6.5.10-tuxcare.3 of org.springframework.integration:spring-integration-xmpp. Target version 6.5.10 is NOT VULNERABLE. The upstream Spring Integration vendor fix for CVE-2026-40987 (commit 82ac6f3b68 by Glenn Renfro @broadcom.com) is present in this version. The affected range is 6.5.0-6.5.8; the fix was introduced in upstream release 6.5.9. TuxCare onboarded upstream version 6.5.10 which already contained the vendor's path-traversal defense.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-47856",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.integration/spring-integration-xmpp@6.5.10-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:303cdfe1-c8be-520a-b496-d8e37cbdfc8e",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47856 is fixed in version 6.5.10-tuxcare.3 of org.springframework.integration:spring-integration-xmpp."
      }
    },
    {
      "id": "CVE-2026-47859",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.integration/spring-integration-xmpp@6.5.10-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:595f668c-a71e-5943-bcd7-63ab64c9093b",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47859 is fixed in version 6.5.10-tuxcare.3 of org.springframework.integration:spring-integration-xmpp."
      }
    },
    {
      "id": "CVE-2026-47861",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.integration/spring-integration-xmpp@6.5.10-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:0df868cb-2aa9-56e7-92cd-427e17982127",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47861 is fixed in version 6.5.10-tuxcare.3 of org.springframework.integration:spring-integration-xmpp."
      }
    },
    {
      "id": "CVE-2026-47862",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.integration/spring-integration-xmpp@6.5.10-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:3fcd4dc5-ae5e-5f6d-a24c-11e284849833",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47862 is fixed in version 6.5.10-tuxcare.3 of org.springframework.integration:spring-integration-xmpp."
      }
    },
    {
      "id": "CVE-2026-47864",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.integration/spring-integration-xmpp@6.5.10-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:74c8a318-1363-5834-87f1-48ac27eb3890",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47864 is fixed in version 6.5.10-tuxcare.3 of org.springframework.integration:spring-integration-xmpp."
      }
    },
    {
      "id": "CVE-2026-47880",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.integration/spring-integration-xmpp@6.5.10-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:1e8cded1-c2a9-5a6d-98f0-6d518ebf7316",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47880 is fixed in version 6.5.10-tuxcare.3 of org.springframework.integration:spring-integration-xmpp."
      }
    },
    {
      "id": "CVE-2026-59274",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.integration/spring-integration-xmpp@6.5.10-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:cc1906ff-2597-5bc2-a7a9-264f3f11fbe8",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59274 is fixed in version 6.5.10-tuxcare.3 of org.springframework.integration:spring-integration-xmpp."
      }
    },
    {
      "id": "CVE-2026-59292",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.integration/spring-integration-xmpp@6.5.10-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:b71626b8-ca54-5890-acf5-e87523c2d267",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59292 is fixed in version 6.5.10-tuxcare.3 of org.springframework.integration:spring-integration-xmpp."
      }
    },
    {
      "id": "CVE-2026-59293",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.integration/spring-integration-xmpp@6.5.10-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:cd4928c9-778e-56a9-bc17-4b25b1df2b0c",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59293 is fixed in version 6.5.10-tuxcare.3 of org.springframework.integration:spring-integration-xmpp."
      }
    },
    {
      "id": "CVE-2026-59307",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.integration/spring-integration-xmpp@6.5.10-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:7922da7b-1cce-5122-ae0e-9ce183ebfb52",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59307 is fixed in version 6.5.10-tuxcare.3 of org.springframework.integration:spring-integration-xmpp."
      }
    },
    {
      "id": "CVE-2026-59311",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.integration/spring-integration-xmpp@6.5.10-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:5b45de70-5a9e-52c0-89ef-8667ad1bdb97",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59311 is fixed in version 6.5.10-tuxcare.3 of org.springframework.integration:spring-integration-xmpp."
      }
    },
    {
      "id": "CVE-2026-59321",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.integration/spring-integration-xmpp@6.5.10-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:f14c0c93-5906-5e50-8828-a7d46007b273",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59321 is fixed in version 6.5.10-tuxcare.3 of org.springframework.integration:spring-integration-xmpp."
      }
    },
    {
      "id": "CVE-2026-59322",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.integration/spring-integration-xmpp@6.5.10-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:7efe3594-5509-51b2-978e-a7d28752d0b8",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59322 is fixed in version 6.5.10-tuxcare.3 of org.springframework.integration:spring-integration-xmpp."
      }
    },
    {
      "id": "CVE-2026-59324",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.integration/spring-integration-xmpp@6.5.10-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:780c9fd4-3042-5cc2-97d3-3c372f137ae5",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59324 is fixed in version 6.5.10-tuxcare.3 of org.springframework.integration:spring-integration-xmpp."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.integration/spring-integration-xmpp@6.5.10-tuxcare.3"
    }
  ]
}