{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:60cba15c-f5be-5c64-a7f6-3b1277064754",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-hateoas",
      "purl": "pkg:maven/org.springframework.hateoas/spring-hateoas@2.5.3-tuxcare.2",
      "type": "library",
      "group": "org.springframework.hateoas",
      "bom-ref": "pkg:maven/org.springframework.hateoas/spring-hateoas@2.5.3-tuxcare.2",
      "version": "2.5.3-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-hateoas",
            "purl": "pkg:maven/org.springframework.hateoas/spring-hateoas@2.5.3",
            "type": "library",
            "group": "org.springframework.hateoas",
            "version": "2.5.3"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2023-34036",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.hateoas/spring-hateoas@2.5.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:0a9e8085-f618-5019-adc0-bf1196f40b1f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-34036 does not affect version 2.5.3-tuxcare.2 of org.springframework.hateoas:spring-hateoas. not_affected \u2014 CVE-2023-34036 affects Spring HATEOAS reactive applications that use UriComponentsBuilder.fromHttpRequest() to build hypermedia links, allowing attackers to inject malicious forwarded headers. The target repository version 2.5.3 already contains the upstream fix (commit 27946144) that replaced fromHttpRequest() with fromUri() in WebFluxLinkBuilder.java line 292. This fix was shipped in upstream...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-41006",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.hateoas/spring-hateoas@2.5.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:ba02c3d8-5465-5b3b-bf87-324eb9178e3b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41006 does not affect version 2.5.3-tuxcare.2 of org.springframework.hateoas:spring-hateoas. The upstream baseline already contains the fix."
      }
    },
    {
      "id": "CVE-2026-41007",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.hateoas/spring-hateoas@2.5.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:57ddb004-1f48-563b-9d2c-cedd50f2c125",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41007 does not affect version 2.5.3-tuxcare.2 of org.springframework.hateoas:spring-hateoas. The upstream baseline already contains the fix."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.hateoas/spring-hateoas@2.5.3-tuxcare.2"
    }
  ]
}