{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:f046a8ca-3da3-56fd-ab6b-6c260ca0a3d9",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-beans",
      "purl": "pkg:maven/org.springframework/spring-beans@6.2.12-tuxcare.2",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-beans@6.2.12-tuxcare.2",
      "version": "6.2.12-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-beans",
            "purl": "pkg:maven/org.springframework/spring-beans@6.2.12",
            "type": "library",
            "group": "org.springframework",
            "version": "6.2.12"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2022-22965",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-beans@6.2.12-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:02b975a2-c741-52e2-9cbb-b93ab82e5f1b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22965 does not affect version 6.2.12-tuxcare.2 of org.springframework:spring-beans. Spring Framework 6.2.12 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22970",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-beans@6.2.12-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:1b49fb1a-5a4f-57fa-83df-d0bb338103bc",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22970 does not affect version 6.2.12-tuxcare.2 of org.springframework:spring-beans. not_affected \u2014 Spring Framework 6.2.12 is not affected by CVE-2022-22970. The vulnerability (DoS via repeated AutoCloseable getter invocations during bean introspection, particularly with MultipartFile) was addressed in the upstream Spring 6.0.0 release (November 2022) before TuxCare onboarded this version. The fix filters AutoCloseable-returning properties from introspection, blocking the attack path describ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-41249",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-beans@6.2.12-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:3b593580-e9f9-5388-8b3a-6105cb029778",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-41249 does not affect version 6.2.12-tuxcare.2 of org.springframework:spring-beans. The target repository (Spring Framework 6.2.12-tuxcare.2) is NOT AFFECTED by CVE-2025-41249. The vulnerability (annotations not detected on methods in type hierarchies with unresolved generics) has already been fixed by the upstream vendor. The fix was shipped in the upstream Spring Framework 6.2.12 release, which TuxCare onboarded on 2a6ad5ff82d2fbcf7e76d0f0bf1303ca0b0cfdda. Both required patches (6d710d482a6785b069e35022e81758953afc21ff and 0e3e34bee0c5b452b51c6ff6184e071a73ee2d40) by Sam Brannen are present in the target's ancestry before any TuxCare modifications.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.3.0, <= 5.3.44; >= 6.0.0, <= 6.1.22; >= 6.2.0, < 6.2.11), cve.org (>= 6.2.x, < 6.2.11; >= 6.1.x, < 6.1.23; >= 5.3.x, < 5.3.45), Snyk (< 6.2.11).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-59282",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-beans@6.2.12-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:1a9d4b3c-5889-5f81-bad6-3aae34d90be0",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.2.12-tuxcare.2 of org.springframework:spring-beans."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-beans@6.2.12-tuxcare.2"
    }
  ]
}