{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:df3f8eb5-fbc7-58f2-9ca8-b17f2320d7cf",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-hateoas",
      "purl": "pkg:maven/org.springframework.hateoas/spring-hateoas@1.5.6-tuxcare.8",
      "type": "library",
      "group": "org.springframework.hateoas",
      "bom-ref": "pkg:maven/org.springframework.hateoas/spring-hateoas@1.5.6-tuxcare.8",
      "version": "1.5.6-tuxcare.8",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-hateoas",
            "purl": "pkg:maven/org.springframework.hateoas/spring-hateoas@1.5.6",
            "type": "library",
            "group": "org.springframework.hateoas",
            "version": "1.5.6"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2023-34036",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.hateoas/spring-hateoas@1.5.6-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:96434f6d-bbf9-50aa-ace2-7ea6a0a98486",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-34036 does not affect version 1.5.6-tuxcare.8 of org.springframework.hateoas:spring-hateoas. not_affected \u2014 The target repository spring-hateoas version 1.5.6-tuxcare.8 is NOT affected by CVE-2023-34036. The vulnerability pattern (trusting malicious forwarded headers when building hypermedia links in reactive WebFlux applications) is absent because the upstream vendor fix was already present in the release that TuxCare onboarded. The fix changes WebFluxLinkBuilder.java line 291 from `UriComponentsBui...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-41006",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.hateoas/spring-hateoas@1.5.6-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:0880b400-dae1-5bf6-997c-7ab51c365918",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41006 is fixed in version 1.5.6-tuxcare.8 of org.springframework.hateoas:spring-hateoas."
      }
    },
    {
      "id": "CVE-2026-41007",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.hateoas/spring-hateoas@1.5.6-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:ba8c3133-264a-5eca-877a-f61630b4df1d",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41007 is fixed in version 1.5.6-tuxcare.8 of org.springframework.hateoas:spring-hateoas."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.hateoas/spring-hateoas@1.5.6-tuxcare.8"
    }
  ]
}