{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:c5fdd7e0-cc3b-5d08-8ead-68eda381d1f8",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-web",
      "purl": "pkg:maven/org.springframework/spring-web@5.3.13-tuxcare.2",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-web@5.3.13-tuxcare.2",
      "version": "5.3.13-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-web",
            "purl": "pkg:maven/org.springframework/spring-web@5.3.13",
            "type": "library",
            "group": "org.springframework",
            "version": "5.3.13"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2016-1000027",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:88a9c375-f64b-5ed4-9226-0ba9692dea30",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.13-tuxcare.2 of org.springframework:spring-web and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required",
        "response": [
          "will_not_fix"
        ]
      }
    },
    {
      "id": "CVE-2021-22060",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:ff996937-2d82-5398-8c16-5f84cea4c703",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2021-22060 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-web."
      }
    },
    {
      "id": "CVE-2022-22950",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:c2c96696-0ea9-55dc-865c-718473d43529",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-22950 affects version 5.3.13-tuxcare.2 of org.springframework:spring-web."
      }
    },
    {
      "id": "CVE-2022-22965",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:1d1600a8-dd21-5ec7-b1ea-2c03e958b1ef",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-22965 affects version 5.3.13-tuxcare.2 of org.springframework:spring-web."
      }
    },
    {
      "id": "CVE-2022-22968",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:5fecc14d-40e3-511c-baf3-0d77fa70b8e6",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-22968 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-web."
      }
    },
    {
      "id": "CVE-2022-22970",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:f4fa65fd-b2c5-5a36-a7c0-de18412d7e01",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-22970 affects version 5.3.13-tuxcare.2 of org.springframework:spring-web."
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:b04b0cd3-a372-5e76-8045-251bb2aa8c94",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-web."
      }
    },
    {
      "id": "CVE-2023-20860",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:848ec30f-0e8e-59a3-8502-fb6d6138ecb6",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2023-20860 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-web."
      }
    },
    {
      "id": "CVE-2023-20861",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:33c1483c-626e-5dcb-8c9d-42b2eba02e9a",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2023-20861 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-web."
      }
    },
    {
      "id": "CVE-2023-20863",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:0bbe7ed5-b22a-5563-b76b-fe4cb4ff4c3b",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2023-20863 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-web."
      }
    },
    {
      "id": "CVE-2024-22243",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:c6d1046b-bf85-5816-a766-4852e0062b2b",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-web."
      }
    },
    {
      "id": "CVE-2024-22259",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:c5586a71-1458-5ed0-98fc-6ecd63c5df13",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-22259 affects version 5.3.13-tuxcare.2 of org.springframework:spring-web."
      }
    },
    {
      "id": "CVE-2024-22262",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:aefe65d8-7375-50db-a269-a7eda0320dd9",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-22262 affects version 5.3.13-tuxcare.2 of org.springframework:spring-web."
      }
    },
    {
      "id": "CVE-2024-38808",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:8b567dde-97b7-516a-853b-0cab5f85bad9",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-web."
      }
    },
    {
      "id": "CVE-2024-38809",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:4368c3dc-1a01-5800-ad34-361899cc3512",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-web."
      }
    },
    {
      "id": "CVE-2024-38816",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:04b09ab2-c238-5a9f-b394-e9e1b7654351",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-web."
      }
    },
    {
      "id": "CVE-2024-38819",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:58e578e1-8fa5-5b92-a927-8532a00ef348",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-web."
      }
    },
    {
      "id": "CVE-2024-38820",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:cad7c13b-07e9-517f-9da3-157ac426b1ee",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-38820 does not affect version 5.3.13-tuxcare.2 of org.springframework:spring-web. not_affected \u2014 Version 5.3.13 is not affected by CVE-2024-38820. This CVE addresses a locale-dependent toLowerCase() bug in DataBinder's field matching, but version 5.3.13 does not contain the vulnerable code pattern. The CVE-2022-22968 fix (which introduced case-insensitive field matching using toLowerCase()) was never applied to this version, so the locale-dependency issue that CVE-2024-38820 fixes cannot e...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-38828",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:7a2064eb-fe68-553d-8e9c-d96d1124f9b6",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-38828 does not affect version 5.3.13-tuxcare.2 of org.springframework:spring-web. not_affected \u2014 Spring Framework 5.3.13 is NOT affected by CVE-2024-38828. The vulnerability was introduced by an optimization commit (gh-31834, 0970b1dc7a) on December 13, 2023, which post-dates version 5.3.13 (released November 11, 2021) by over 2 years. Version 5.3.13 properly allocates ContentCachingRequestWrapper's buffer using the contentCacheLimit parameter, never reading request.getContentLength() when...",
        "justification": "code_not_reachable"
      }
    },
    {
      "id": "CVE-2025-22233",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:770924a3-02e9-5490-8520-f14640ba85ee",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-22233 affects version 5.3.13-tuxcare.2 of org.springframework:spring-web."
      }
    },
    {
      "id": "CVE-2025-41242",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:d41575e2-06e0-57a5-8f98-648a043bc3dd",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-web."
      }
    },
    {
      "id": "CVE-2025-41249",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:38711f9a-99f1-5361-be25-87d3eacd0dc6",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-web."
      }
    },
    {
      "id": "CVE-2025-41254",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:ae3f96df-9463-557e-919e-7600f7fa82ab",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-41254 affects version 5.3.13-tuxcare.2 of org.springframework:spring-web."
      }
    },
    {
      "id": "CVE-2026-22735",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:c335816b-5c93-589a-aa4c-c8bac140e45b",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-web."
      }
    },
    {
      "id": "CVE-2026-22737",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:aa627f49-d532-53f4-af6b-cab7420e52c6",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-web."
      }
    },
    {
      "id": "CVE-2026-22740",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:ab7eebcf-9a4c-5e95-a8f5-02b9395d2803",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-web."
      }
    },
    {
      "id": "CVE-2026-22741",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:155acc22-421b-5bd9-8760-704813a9194d",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-web."
      }
    },
    {
      "id": "CVE-2026-22745",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:66820825-521a-53db-83e7-3be5e996b43d",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-web."
      }
    },
    {
      "id": "CVE-2026-41838",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:0b02626b-fb1f-53d3-939e-a715448966f5",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41838 affects version 5.3.13-tuxcare.2 of org.springframework:spring-web."
      }
    },
    {
      "id": "CVE-2026-41839",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:8b9c89dd-fbfc-588d-93f6-3012fe940214",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-web."
      }
    },
    {
      "id": "CVE-2026-41840",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:9343ff03-74e2-5c91-8f28-94fef8110643",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41840 affects version 5.3.13-tuxcare.2 of org.springframework:spring-web."
      }
    },
    {
      "id": "CVE-2026-41841",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:6d7c0e97-ef2c-5924-8a68-e3157c77a7e6",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-web."
      }
    },
    {
      "id": "CVE-2026-41842",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:17d9bc8a-ec33-57ee-af4e-e5dc96230ce5",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-web."
      }
    },
    {
      "id": "CVE-2026-41843",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:b4369b05-3086-598f-b306-590ae2aa8a53",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41843 affects version 5.3.13-tuxcare.2 of org.springframework:spring-web."
      }
    },
    {
      "id": "CVE-2026-41844",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:62b2bb8f-6184-549c-9474-b57521e5d337",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41844 affects version 5.3.13-tuxcare.2 of org.springframework:spring-web."
      }
    },
    {
      "id": "CVE-2026-41845",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:5fa03b5d-5a1d-5f46-8ab7-6174ba3b0485",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-web."
      }
    },
    {
      "id": "CVE-2026-41846",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:273190f8-5b53-5de8-abb2-8f8106eff3be",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41846 affects version 5.3.13-tuxcare.2 of org.springframework:spring-web."
      }
    },
    {
      "id": "CVE-2026-41847",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:166d1b4b-bb3d-5658-ac38-c2d71e9f85bd",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41847 affects version 5.3.13-tuxcare.2 of org.springframework:spring-web."
      }
    },
    {
      "id": "CVE-2026-41848",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:bf121b8d-6e05-527a-9c3e-23372cf394e8",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41848 affects version 5.3.13-tuxcare.2 of org.springframework:spring-web."
      }
    },
    {
      "id": "CVE-2026-41849",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:49cfbcd7-b986-5c2b-805f-01eee63a1338",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41849 affects version 5.3.13-tuxcare.2 of org.springframework:spring-web."
      }
    },
    {
      "id": "CVE-2026-41850",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:6bacf3ea-a88e-50c9-92c9-53dfa1bc267c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41850 affects version 5.3.13-tuxcare.2 of org.springframework:spring-web."
      }
    },
    {
      "id": "CVE-2026-41851",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:aa5fbc8a-34bd-5c9b-9080-59c786e21138",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41851 affects version 5.3.13-tuxcare.2 of org.springframework:spring-web."
      }
    },
    {
      "id": "CVE-2026-41852",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:b9e1fbab-346e-5fca-bd6d-f9c1d205a2c8",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41852 affects version 5.3.13-tuxcare.2 of org.springframework:spring-web."
      }
    },
    {
      "id": "CVE-2026-41853",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:15204fbf-6aed-5532-b614-64904ef6d61a",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41853 affects version 5.3.13-tuxcare.2 of org.springframework:spring-web."
      }
    },
    {
      "id": "CVE-2026-41854",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:a23d46e7-c344-53fe-9e63-61799988da56",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41854 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-web."
      }
    },
    {
      "id": "CVE-2026-41855",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:51ace1f3-76e0-5645-a43b-97379f032693",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-web."
      }
    },
    {
      "id": "CVE-2026-47884",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:b953e9e8-3009-5fcd-aac7-21b768e02988",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-web."
      }
    },
    {
      "id": "CVE-2026-47886",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:1914ca0d-b243-5f97-8559-15d2cc6a7773",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-web."
      }
    },
    {
      "id": "CVE-2026-47887",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:4b624611-96a0-5561-933a-4ac895ac134a",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-web."
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:eb577594-02fc-5524-a7b6-8b4d9e3b486c",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-web."
      }
    },
    {
      "id": "CVE-2026-47890",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:87e52197-7b8f-54ba-a6a5-5f1cd35b1394",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-47890 does not affect version 5.3.13-tuxcare.2 of org.springframework:spring-web. Target version 5.3.13 is not affected by CVE-2026-47890. The vulnerability requires SSE (Server-Sent Events) Fragment streaming functionality, which was introduced in Spring Framework 6.2.0 (August 2024). Version 5.3.13 predates this feature entirely - the vulnerable code path does not exist. The CVE affects versions 6.2.0-6.2.19 and 7.0.0-7.0.8, all of which postdate the target version.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-47891",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:524a968a-a82f-505f-a58a-f2970d999a49",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-web."
      }
    },
    {
      "id": "CVE-2026-47892",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:14c6fb1f-7ba9-510f-93ab-adf745f552cc",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-web."
      }
    },
    {
      "id": "CVE-2026-47893",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:67473b1a-6641-5e0c-9607-f9ab7972fa0e",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-web."
      }
    },
    {
      "id": "CVE-2026-59280",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:03cfc489-37e4-50ca-9881-fcd9c34f7132",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-web."
      }
    },
    {
      "id": "CVE-2026-59281",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:494c8c7b-66bc-5eb6-9ff8-6cce684c90af",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-web."
      }
    },
    {
      "id": "CVE-2026-59282",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:19270833-b8bb-5d62-82eb-841db6bf63bb",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-web."
      }
    },
    {
      "id": "CVE-2026-59283",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:e76d3a16-8d77-5155-aad8-c9fffec450aa",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-web."
      }
    },
    {
      "id": "CVE-2026-59313",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:e75d9dc4-9a88-5027-8697-348c4afcc896",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-web."
      }
    },
    {
      "id": "CVE-2026-59314",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-web@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:5cfab1f3-f9d2-55c1-a2ad-b238e6411ab4",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-web."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-web@5.3.13-tuxcare.2"
    }
  ]
}